VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 25, 2022· Updated May 21, 2025

Use After Free in vim/vim

CVE-2022-3297

Description

Use-after-free in Vim's tagfile completion before 9.0.0579 can cause memory corruption when a buffer is wiped during 'tagfunc' execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in Vim's tagfile completion before 9.0.0579 can cause memory corruption when a buffer is wiped during 'tagfunc' execution.

Vulnerability

A use-after-free vulnerability exists in Vim's tag completion functionality (ins_compl_next_buf and related code). When the 'tagfunc' option is configured and tag completion is invoked, the function ins_compl_get_exp and associated state management may continue to use a buffer pointer after the buffer has been freed. The flaw affects all Vim versions prior to the patch in commit 0ff01835a40f549c5c4a550502f62a2ac9ac447c, which introduces 9.0.0579 [1].

Exploitation

An attacker must convince a victim to trigger tag completion (e.g., by opening a specially crafted file or executing a command that invokes 'tagfunc') while the buffer being completed is freed or wiped out. The attacker can control the 'tagfunc' to cause the buffer to be freed during completion processing. The specific sequence involves the ins_compl_next_buf function accessing freed memory when 'tagfunc' wipes out the buffer [1].

Impact

Successful exploitation of the use-after-free can lead to memory corruption. This could result in a denial of service (crash) or, under favorable memory layout conditions, arbitrary code execution with the privileges of the Vim process.

Mitigation

The vulnerability is fixed in Vim version 9.0.0579, released with the commit referenced in [1]. Users should update to this version or later. No workarounds are documented, but avoiding untrusted 'tagfunc' definitions or completing buffers from untrusted sources may reduce risk.

References
  1. patch 9.0.0579: using freed memory when 'tagfunc' wipes out buffer · vim/vim@0ff0183

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.