CVE-2022-0413: 
NixOS vulnerability analysis and mitigation

A Use-After-Free vulnerability was discovered in Vim editor prior to version 8.2, identified as CVE-2022-0413. The vulnerability occurs when the substitute command uses a recursive function call, potentially leading to memory corruption (CVE, Red Hat).

The vulnerability exists in the substitute functionality of Vim when it uses a recursive function call. The issue specifically occurs in src/ex_cmds.c where the substitute text memory is freed but still accessed afterward. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (Ubuntu).

If successfully exploited, this vulnerability could lead to a denial-of-service condition through application crash or potentially have other unspecified impacts due to the use of freed memory (Debian LTS).

The vulnerability has been fixed in Vim version 8.2.4253 with a patch that makes a copy of the substitute text before processing. Users are recommended to upgrade to the fixed version. The fix involves modifying the substitute command handling to prevent the use-after-free condition (GitHub Commit).