Use After Free in vim/vim

Vulnerability

The use-after-free vulnerability exists in the do_ecmd function of Vim versions prior to 9.0.1840. The bug occurs when resetting visual mode before switching buffers; an autocommand triggered by ModeChanged can free the window (oldwin), leading to a use-after-free condition when oldwin is later dereferenced without a validity check [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious file that, when opened with Vim, triggers the vulnerable code path. The user must open the file using Vim (e.g., by running vim malicious_file). No authentication or special privileges are required beyond normal file access. The exploit utilizes autocommands that fire during buffer switching to free the window structure, causing the use-after-free.

Impact

Successful exploitation can lead to arbitrary code execution or unexpected termination of Vim. The impact is limited to the application context, but if Vim is used in elevated environments (e.g., editing system files with sudo), code execution could lead to privilege escalation.

Mitigation

The vulnerability is fixed in Vim version 9.0.1840, released on September 3, 2023 [2]. Users should update to this version or later. No workarounds are available; applying the patch is the recommended action. Linux distributions such as Fedora have issued package updates, though the specific advisories are not fully accessible.