VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 26, 2022· Updated Apr 15, 2025

vim autocmd quickfix.c qf_update_buffer use after free

CVE-2022-3705

Description

CVE-2022-3705 is a use-after-free in Vim's quickfix buffer update when filetype autocommands execute, patched in 9.0.0805.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2022-3705 is a use-after-free in Vim's quickfix buffer update when filetype autocommands execute, patched in 9.0.0805.

Vulnerability

A use-after-free vulnerability exists in Vim's qf_update_buffer function in quickfix.c, triggered when filetype autocommands modify the quickfix or location list during a buffer update [2]. The issue affects Vim versions prior to 9.0.0805; the patch is commit d0fab10ed2a86698937e3c3fed2f10bd9bb5e731 [1][2].

Exploitation

An attacker can exploit this remotely by crafting a file that, when opened in Vim, triggers a FileType autocmd. The autocmd calls setloclist or setqflist with the 'f' action while the quickfix buffer update is in progress, causing the freed memory access. No authentication is required, but the user must open the malicious file in Vim [1][2].

Impact

Successful exploitation leads to a use-after-free condition, which may allow code execution or denial of service. The attacker gains access to freed memory, potentially leading to arbitrary code execution in the context of the Vim process [1][2].

Mitigation

Upgrade to Vim version 9.0.0805 or later, which includes the patch adding incr_quickfix_busy() and decr_quickfix_busy() guards to prevent the race condition [2]. No workaround is available for unpatched versions. Apple included the fix in macOS Ventura 13.2 [1]. Fedora package announcements are pending [3][4].

References
  1. About the security content of macOS Ventura 13.2 - Apple Support
  2. patch 9.0.0805: filetype autocmd may cause freed memory access · vim/vim@d0fab10
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

49

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.