CVE-2022-4141: 
NixOS vulnerability analysis and mitigation

CVE-2022-4141 is a heap-based buffer overflow vulnerability discovered in Vim versions 9.0.0946 and below. The vulnerability was disclosed on November 25, 2022, affecting the text editor's functionality when using CTRL-W gf in the expression used in the right-hand side (RHS) of the substitute command (Debian Tracker, Red Hat CVE).

The vulnerability occurs due to invalid memory access in the substitute command when combined with a function that navigates to another file. The issue specifically manifests when using the CTRL-W gf command in the expression used in the RHS of the substitute command. The vulnerability has been assigned a CVSS v3.1 score of 7.8 (HIGH) (NVD Results).

The heap-based buffer overflow vulnerability could potentially lead to denial-of-service (application crash) or other unspecified impacts when exploited (Debian LTS).

The vulnerability has been fixed in Vim version 9.0.0947 and later releases. Users are advised to upgrade to the patched version. Various distributions have released security updates, including Fedora (9.0.1006-1), Debian (2:8.1.0875-5+deb10u5), and others (Fedora Update, Debian LTS).