cve/2024/CVE-2024-47814.md

### [CVE-2024-47814](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47814)
![](https://img.shields.io/static/v1?label=Product&message=vim&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%20v9.1.0764%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%3A%20Use%20After%20Free&color=brightgreen)

### Description

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

### POC

#### Reference
- https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/gandalf4a/crash_report
- https://github.com/w4zu/Debian_security