CVE-2024-47814

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-47814)

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• SECURITY UPDATE: fix use-after-free vulnerability in buffer closing
  • debian/patches/CVE-2024-47814.patch: Fix use-after-free issue when closing a buffer by checking for deletions before editing
  • CVE-2024-47814

• CVE-2021-3875: fix ml_get error after search with range; clamp ea->line2 to the buffer length in get_address() so out-of-range addresses do not produce an out-of-bounds read (ex_docmd.c, upstream patch 8.2.3489)
• CVE-2022-4293: fix crash when dividing the largest negative integer by -1 in num_divide(); detect the LONG_MIN / -1 case and clamp the result (typval.c, upstream patch 9.0.0913)
• CVE-2023-48231: fix use-after-free in win_close() when an autocmd closes a previously-validated window; re-check window validity before setting w_closing (window.c, upstream patch 9.0.2106)
• CVE-2023-48235: fix integer overflow in ex address parsing; verify lnum is positive before subtracting from LONG_MAX in get_address() and add e_line_number_out_of_range[] in src/errors.h (ex_docmd.c + errors.h, upstream patches 8.2.3659 + 9.0.2110)
• CVE-2024-41957: fix use-after-free in tagstack_clear_entry(); use VIM_CLEAR to NULL pointers when freeing the tagstack on win_free (window.c, upstream patch 9.1.0647)
• CVE-2024-43374: fix use-after-free in alist_add(); lock the current window across the buflist_add() autocmd window so its tagstack reference cannot be freed underneath us (arglist.c, upstream patch 9.1.0678)
• CVE-2024-47814: fix use-after-free when closing a buffer; abort do_ecmd() if the new buffer is marked for deletion via b_locked or b_locked_split (ex_cmds.c, upstream patch 9.1.0764)

Use-after-free when closing buffers in Vim < v9.1.0764. (CVE-2024-47814)

This update for vim fixes the following issues:

• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)

Other fixes:

• Updated to version 9.1.0836

This update for vim fixes the following issues:

• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)

Other fixes:

• Remove patch that introduced a bug caused significantly more CPU usage (bsc#1220618)
• Updated to version 9.1.0836

This update for vim fixes the following issues:

vim was updated to 9.1.1101:

• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)
• CVE-2024-43790: Fixed Out of bounds read when performing a search command (bsc#1229685)
• CVE-2024-43802: Fixed heap-buffer-overflow in ins_typebuf() (bsc#1229822)
• CVE-2024-45306: Fixed heap-buffer-overflow in Vim (bsc#1230078)
• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2025-1215: Fixed manipulation of the argument --log leads to memory corruption (bsc#1237137)
• CVE-2025-22134: Fixed heap-buffer-overflow in Vim < 9.1.1003 (bsc#1235695)
• CVE-2025-24014: Fixed segmentation fault in win_line() in Vim < 9.1.1043 (bsc#1236151)

Update to 9.1.1101:

• insexpand.c hard to read
• tests: Test_log_nonexistent only works on Linux
• Update base-syntax, improve variable matching
• Vim9: import with extends may crash
• leaking memory with completing multi lines
• --log with non-existent path causes a crash
• if_perl: Perl 5.38 adds new symbols causing link failure
• tests: matchparen plugin test wrongly named
• Vim9: problem finding implemented method in type hierarchy
• runtime(qf): Update syntax file, match second delimiter
• tests: output of test ...win32_ctrl_z depends on python version
• tests: fix expected return code for python 3.13 on Windows
• tests: timeout might be a bit too small
• tests: test_terminwscroll_topline2 unreliable
• tests: No check when tests are run under Github actions
• tests: plugin tests are named inconsistently
• Vim9: import with extends may crash
• completion doesn't work with multi lines
• filetype: cmmt files are not recognized
• Unable to persistently ignore events in a window and its buffers
• improve syntax highlighting
• setreg() doesn't correctly handle mbyte chars in blockwise mode
• unexpected DCS responses may cause out of bounds reads
• has('bsd') is true for GNU/Hurd
• filetype: Mill files are not recognized
• GUI late startup leads to uninitialized scrollbars
• Add support for lz4 to tar & gzip plugin
• Terminal ansi colors off by one after tgc reset
• included syntax items do not understand contains=TOP
• vim_strnchr() is strange and unnecessary
• Vim9: len variable not used in compile_load()
• runtime(vim): Update base-syntax, match :debuggreedy count prefix
• Strange error when heredoc marker starts with "trim"
• tests: test_compiler fails on Windows without Maven
• 'diffopt' "linematch" cannot be used with {n} less than 10
• args missing after failing to redefine a function
• Cannot control cursor positioning of getchar()
• preinsert text completions not deleted with <C-W>/<C-U>
• getchar() can't distinguish between C-I and Tab
• tests: Test_termwinscroll_topline2 fails on MacOS
• heap-use-after-free and stack-use-after-scope with :14verbose
• no digraph for "Approaches the limit"
• not possible to use plural forms with gettext()
• too many strlen() calls in userfunc.c
• terminal: E315 when dragging the terminal with the mouse
• runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
• runtime(doc): Tweak documentation style a bit
• tests: test_glvs fails when unarchiver not available
• Vim always enables 'termguicolors' in a terminal
• completion: input text deleted with preinsert when adding leader
• translation(sr): Missing Serbian translation for the tutor
• Superfluous cleanup steps in test_ins_complete.vim
• runtime(netrw): correct wrong version check
• Vim doesn't highlight to be inserted text when completing
• runtime(netrw): upstream snapshot of v176
• runtime(dist/vim9): fix regressions in dist#vim9#Open
• runtime(hyprlang): fix string recognition
• make install fails because of a missing dependency
• runtime(asm): add byte directives to syntax script
• Vim doesn't work well with TERM=xterm-direct
• runtime(filetype): commit 99181205c5f8284a3 breaks V…

It was discovered that Vim incorrectly handled memory when closing a buffer, leading to use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service.