Use After Free in vim/vim

Vulnerability

A use-after-free vulnerability exists in the is_qf_win() function in Vim prior to version 9.0.1857 [2]. The bug is triggered in the quickfix window handling code when processing a specially crafted file, causing a heap-use-after-free condition [2]. All versions before the fix are affected.

Exploitation

An attacker can exploit this by crafting a malicious file that, when opened by a victim in Vim, triggers the use-after-free in is_qf_win() [2]. No special privileges are required beyond the ability to convince the victim to open the file. The Vim project's test case demonstrates the crash using a proof-of-concept file [2].

Impact

Successful exploitation can lead to arbitrary code execution in the context of the Vim process [1]. The impact may also include unexpected application termination (denial of service) [1]. The attacker could potentially execute arbitrary commands or compromise the system if Vim is running with elevated privileges.

Mitigation

The vulnerability is fixed in Vim version 9.0.1857, released as part of the patch series [2]. Users should update to the latest version. Apple included the fix in macOS Sonoma 14.1 [1]. Fedora package announcements were made [3][4], but the content is unavailable; users should apply updates from their distribution. No workaround is described; updating is the recommended mitigation.