Vim heap-use-after-free in src/arglist.c:207

Vulnerability

Vim versions prior to 9.1.0678 contain a use-after-free vulnerability in the argument list handling (alist_add()). When adding a new file to the argument list, Buf* autocommands are triggered. If an autocommand closes the buffer that was just opened (including its window), the window structure is freed, which contains a reference to the argument list being modified. After autocommands complete, the references become invalid, leading to a use-after-free [1][2].

Exploitation

An attacker needs to either intentionally add unusual autocommands that wipe a buffer during creation or source a malicious plugin that does so. The user must have autocommands enabled and trigger the addition of a file to the argument list while such autocommands are active. No special network position or authentication is required beyond local access to Vim [1].

Impact

Successful exploitation results in a crash of Vim (denial of service). The impact is considered low because it requires specific user actions or a malicious plugin. No code execution or data disclosure is indicated in the available references [1].

Mitigation

The issue is fixed in Vim patch v9.1.0678 [1][2]. Users should update to this version or later. There is no known workaround; users should avoid sourcing untrusted plugins that define autocommands that close buffers during creation [1].