VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 25, 2022· Updated Aug 3, 2024

Use After Free in vim/vim

CVE-2022-2982

Description

A use-after-free vulnerability in Vim's 'quickfixtextfunc' option can be triggered under recursive calls, potentially leading to memory corruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in Vim's 'quickfixtextfunc' option can be triggered under recursive calls, potentially leading to memory corruption.

Vulnerability

A use-after-free vulnerability exists in Vim prior to version 9.0.0260, specifically in the call_qftf_func() function handling the 'quickfixtextfunc' option. When the function is called recursively (e.g., via side effects in a user-defined function), the freed memory could be accessed because the code did not properly guard against reentrancy. The commit [1] introduces a static recursive flag to prevent such recursive invocations.

Exploitation

An attacker would need to convince a user to open a specially crafted file (or trigger a quickfix list operation) that causes the 'quickfixtextfunc' option to be invoked recursively. The attacker does not need network access or authentication, only the ability to supply content that triggers the vulnerable code path via user interaction (e.g., opening a file in Vim or running a quickfix command). The recursive call leads to use of freed memory.

Impact

Successful exploitation could lead to memory corruption, potentially resulting in a denial of service (crash) or, depending on memory layout, arbitrary code execution. The vulnerability affects the confidentiality, integrity, and availability of the Vim process [1][3].

Mitigation

The fix is included in Vim version 9.0.0260, released on 2022-08-25 [1]. Users should upgrade to at least that version. Gentoo users can update to >=9.0.1157 as per GLSA 202305-16 [3]. No workaround is available; the only mitigation is to apply the patch.

References
  1. patch 9.0.0260: using freed memory when using 'quickfixtextfunc' recu… · vim/vim@d6c6762
  2. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

41

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing recursion guard in call_qftf_func allows re-entrant execution on freed quickfix list memory."

Attack vector

An attacker can trigger a use-after-free by crafting a scenario where `call_qftf_func` is invoked recursively. When the `'quickfixtextfunc'` option is set, the function calls back into user-defined code that may itself trigger another quickfix text update, causing the function to re-enter before the first invocation has finished. This recursive call operates on freed or about-to-be-freed memory, leading to a use-after-free condition [ref_id=1].

Affected code

The vulnerability is in the `call_qftf_func` function in Vim's quickfix code. The function retrieves text via the user-supplied `'quickfixtextfunc'` option, but it could be called recursively while the quickfix list or other internal data structures were in an inconsistent state, leading to a use-after-free.

What the fix does

The patch introduces a static `recursive` flag in `call_qftf_func`. On entry, if `recursive` is already `TRUE`, the function returns `NULL` immediately, preventing re-entrancy. The flag is set to `TRUE` at the start of the function and reset to `FALSE` on every exit path (including error paths). This simple guard ensures the function cannot be called recursively, eliminating the use-after-free condition [ref_id=1].

Preconditions

  • configThe 'quickfixtextfunc' option must be set to a user-defined function that can trigger a recursive quickfix update.
  • inputThe attacker must be able to supply or influence the quickfix list content to cause the recursive invocation.

Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.