VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 16, 2023· Updated Feb 13, 2025

Use-After-Free in win_close() in vim

CVE-2023-48231

Description

A use-after-free vulnerability in Vim's win_close() function can crash the editor when closing a window; fixed in version 9.0.2106.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in Vim's win_close() function can crash the editor when closing a window; fixed in version 9.0.2106.

Vulnerability

A use-after-free vulnerability exists in the win_close() function of Vim, an open source command line text editor. When closing a window, Vim may attempt to access an already freed window structure. The issue affects all versions prior to 9.0.2106. The fix, introduced in commit 25aabc2b, adds a check if (!win_valid(win)) return FAIL; before accessing window-related variables, preventing the use of freed memory [1][2].

Exploitation

An attacker would need to craft a sequence of window operations that triggers the use-after-free condition. The advisory notes that exploitation beyond crashing is not easy and would likely require user interaction, such as opening a specially crafted file or executing a malicious script. The specific steps involve manipulating window closing events to cause the freed window structure to be accessed [1].

Impact

Successful exploitation can lead to a crash of the Vim editor, resulting in a denial of service. The advisory states that exploitation to achieve arbitrary code execution has not been demonstrated and is considered unlikely. The overall impact is rated as low [1].

Mitigation

The vulnerability is fixed in Vim patch 9.0.2106, released on November 16, 2023. Users should upgrade to version 9.0.2106 or later. No known workarounds are available [1][2].

References
  1. security - [vim-security] several minor security issues in Vim v9.0.2106-v9.0.2112
  2. patch 9.0.2106: [security]: Use-after-free in win_close() · vim/vim@25aabc2

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

27

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.