VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 11, 2023· Updated Feb 13, 2025

Use After Free in vim/vim

CVE-2023-5535

Description

Vim before v9.0.2010 has a use-after-free in buf_contents_changed() that can be triggered by autocommands, potentially causing heap corruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim before v9.0.2010 has a use-after-free in buf_contents_changed() that can be triggered by autocommands, potentially causing heap corruption.

Vulnerability

A use-after-free vulnerability exists in buf_contents_changed() in Vim prior to v9.0.2010 [1]. The function compares the current buffer's content with the file on disk, but during this operation autocommands can execute and wipe or free the buffer that is being accessed, leading to a use-after-free [1].

Exploitation

An attacker would need to craft a file that, when opened in Vim, triggers a sequence of autocommands that execute during the buf_contents_changed() call [1]. The autocommands can cause the buffer to be wiped, while the function continues to use the freed memory [1]. No special network position or authentication is required if the victim opens the malicious file.

Impact

Successful exploitation results in heap memory corruption [1]. Depending on the heap layout and the freed memory content, this could lead to a crash or potentially arbitrary code execution. The victim's Vim session would be compromised, and the attacker could read or modify files that Vim has access to.

Mitigation

Update to Vim v9.0.2010 or later, which includes the fix that blocks autocommands during the buffer comparison [1]. The fix adds block_autocmds() and unblock_autocmds() calls around the critical section in buf_contents_changed() [1]. Fedora has also released package updates containing the patched version [2][3][4].

References
  1. patch 9.0.2010: [security] use-after-free from buf_contents_changed() · vim/vim@41e6f7d
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.