CVE-2024-47814

What it actually does

Use-after-free in buffer close handling triggered when a BufWinLeave autocmd reopens the same buffer in a new split window.

Why it matters to the business

Potential editor crashes for users with custom buffer-handling automation; minimal operational disruption given the narrow preconditions.

How an attack unfolds

An attacker with the ability to influence a target's Vim configuration plants a BufWinLeave autocmd that reopens the buffer being closed; subsequent buffer unload commands trigger the use-after-free and possible crash. No widespread exploitation observed.

How to fix it

Upgrade vim/vim to the commit 51b62387be93c65fa56bbabe1c3c1ea5df187641 (Vim 9.1.0764) or later; no workarounds exist.

How to confirm the fix worked

Confirm Vim version reports 9.1.0764 or newer; verify the listed commit is present in the source tree.

Typical attack path

1. Configure BufWinLeave autocmd that reopens the target buffer in a split window
2. Execute buffer close or unload commands
3. Trigger use-after-free during window/buffer teardown

How to detect it

Review Vim configuration files and logs for BufWinLeave autocmds that reopen buffers; inspect crash reports or core dumps showing buffer teardown faults. No public exploitation artifacts are known.

What your security team should do

• Upgrade all Vim installations to the fixed commit immediately
• Audit custom vimrc and plugin autocmds for buffer lifecycle handlers
• Monitor upstream Vim releases for related buffer-handling fixes