CVE-2024-43374

What it actually does

Use-after-free in Vim argument list handling: Buf* autocommands triggered on new file addition can close the newly created buffer/window, freeing the window structure that still holds a reference to the argument list being modified; subsequent access after autocommand completion uses the dangling reference.

Why it matters to the business

May cause Vim to crash when a user sources a malicious plugin or unusual autocommands, leading to loss of unsaved work and workflow interruption; impact remains low because exploitation requires deliberate or malicious configuration and no remote code execution or data theft is possible.

How an attack unfolds

An attacker crafts a Vim plugin or configuration that registers Buf* autocommands to delete the buffer and its window during argument-list insertion; once the autocommands finish, Vim dereferences the now-freed window and argument-list pointers, resulting in a crash.

How to fix it

Upgrade Vim to version 9.1.0678 or later (commit 0a6e57b09bc8c76691b367a5babfb79b31b770e8). Rebuild from source or obtain updated packages from distribution maintainers. Review and remove any third-party plugins that manipulate buffers inside Buf* autocommands during argument-list operations.

How to confirm the fix worked

Run 'vim --version' and confirm the patch level is at least 9.1.0678. Test the reproducer by sourcing a minimal autocommand that wipes the buffer on BufNew and then adding a file to the argument list; the editor should no longer crash.

Typical attack path

1. User opens Vim with a malicious plugin or autocommand file sourced
2. Plugin registers Buf* autocommands that wipe the buffer on creation
3. User or script adds a new file to the argument list
4. Autocommands fire, closing the buffer and freeing the window structure
5. Vim continues argument-list modification using the now-invalid references
6. Process crashes due to use-after-free

How to detect it

Examine system and application logs for unexpected Vim segmentation faults or aborts around the time users report editor instability; correlate with recent sourcing of unknown .vim files or plugins. No network or file-based IOCs are known because the flaw requires local configuration.

What your security team should do

• Prioritize patching Vim instances that allow user-supplied plugins or configurations
• Audit plugin directories for any code registering Buf* autocommands that delete buffers
• Block execution of untrusted .vim files and plugins via organizational policy
• Monitor for new Vim releases and automate version checks in developer environments