CVE-2021-3928

HIGH

vim < 8.2.3582 - Use of Uninitialized Variable

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-3928. PoCs published by cemonatk.

AI-analyzed exploit summary This repository contains a detailed technical analysis of CVE-2021-3928, a stack-based buffer overflow in Vim's spell-checking functionality. It includes a stack trace, AddressSanitizer output, and references to patches and advisories, but does not include functional exploit code.

Description

vim is vulnerable to Use of Uninitialized Variable

Exploits (1)

github WRITEUP 3 stars
by cemonatk · poc
https://github.com/cemonatk/onefuzzyway/tree/main/CVEs/vim/CVE-2021-3928.md

This repository contains a detailed technical analysis of CVE-2021-3928, a stack-based buffer overflow in Vim's spell-checking functionality. It includes a stack trace, AddressSanitizer output, and references to patches and advisories, but does not include functional exploit code.

Classification
Writeup 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Vim (versions prior to the fix)
No auth needed
Prerequisites: Vim compiled with AddressSanitizer · specific POC file (not included in the repo)
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (9)

Core 9
Core References
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2022/01/15/1
Mitigation, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202208-32
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html

Scores

CVSS v3 7.8
EPSS 0.0059
EPSS Percentile 43.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-457 CWE-908
Status published
Products (6)
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
vim/vim < 8.2.3582
Published Nov 05, 2021
Tracked Since Feb 18, 2026