CVE-2024-47814CWE-416

use-after-free when closing buffers in Vim

Low · published October 7, 2024

CVSS v3.1
3.9
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.9th percentile
Weakness
CWE-416 · Use After Free
Published
2024-10-07T21:16Z
EPSS history
Timeline
  • 07 OCT 21:16Z
    use-after-free when closing buffers in Vim
    cvelistv5