CVE-2023-4750: Vim Use After Free Vulnerability

CVE-2023-4750 Overview

CVE-2023-4750 is a use-after-free vulnerability [CWE-416] in the Vim text editor affecting versions prior to 9.0.1857. The flaw resides in the is_qf_win() function within Vim's quickfix and location list handling code. When an autocommand closes a buffer associated with a quickfix or location list window, subsequent code paths can dereference the freed buffer pointer. Exploitation requires local access and user interaction, typically by convincing a target to open a crafted file in Vim. Successful exploitation can lead to arbitrary code execution in the context of the user running Vim.

Critical Impact
A local attacker who induces a user to open a malicious file in Vim can achieve heap-use-after-free conditions in is_qf_win(), potentially resulting in arbitrary code execution with the privileges of the Vim process.

Affected Products

Vim versions prior to 9.0.1857
Fedora 37, 38, and 39
Apple macOS (addressed in Apple Support article HT213984)

Discovery Timeline

2023-09-04 - CVE-2023-4750 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4750

Vulnerability Analysis

The vulnerability is a heap use-after-free condition in Vim's quickfix subsystem. The is_qf_win() function evaluates whether a window displays a quickfix or location list buffer by inspecting win->w_buffer. When an autocommand closes the underlying buffer before this check executes, the w_buffer pointer references freed heap memory. Calling bt_quickfix() on the stale pointer dereferences memory that has already been deallocated.

The issue surfaces during operations that iterate windows across tabs while autocommands are permitted to execute. An attacker crafts a file containing autocommand triggers that free the buffer mid-iteration, leaving dangling pointers in the window structures the quickfix code later accesses.

Root Cause

The root cause is missing validation of buffer pointers after autocommand execution. Vim's window iteration assumed w_buffer remained valid throughout the loop, but autocommands can free buffers asynchronously relative to caller expectations. The fix adds explicit buf_valid() checks before any quickfix-type test on win->w_buffer.

Attack Vector

Exploitation requires local access and user interaction. The attacker delivers a crafted file or script that, when opened in Vim, triggers autocommands that close a buffer while quickfix processing is active. The resulting use-after-free can be shaped into arbitrary code execution through heap layout manipulation.

// Security patch in src/quickfix.c (Vim 9.0.1857)
// Adds buf_valid() check before dereferencing win->w_buffer
    // set to NULL.
    // A window displaying a location list buffer will have the w_llist_ref
    // pointing to the location list.
-    if (bt_quickfix(win->w_buffer))
+    if (buf_valid(win->w_buffer) && bt_quickfix(win->w_buffer))
	if ((IS_QF_STACK(qi) && win->w_llist_ref == NULL)
		|| (IS_LL_STACK(qi) && win->w_llist_ref == qi))
	    return TRUE;
// Source: https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7ed

A companion change in src/main.c applies the same guard during tab and window iteration:

// Security patch in src/main.c (Vim 9.0.1857)
 	    next_tp = tp->tp_next;
 	    FOR_ALL_WINDOWS_IN_TAB(tp, wp)
 	    {
-		if (wp->w_buffer == NULL)
+		if (wp->w_buffer == NULL || !buf_valid(wp->w_buffer))
 		    // Autocmd must have close the buffer already, skip.
 		    continue;
 		buf = wp->w_buffer;
// Source: https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7ed

Detection Methods for CVE-2023-4750

Indicators of Compromise

Unexpected crashes of the vim process with SIGSEGV or heap corruption signatures during file editing or quickfix operations.
Vim binaries on disk with versions earlier than 9.0.1857, identifiable via vim --version.
Crafted files containing aggressive autocommand definitions targeting buffer close events such as BufDelete or BufUnload.

Detection Strategies

Inventory installed Vim packages across Linux, macOS, and developer workstations and compare versions against 9.0.1857.
Hunt for files distributed to users that contain Vim modelines or autocommand sequences manipulating quickfix and location list state.
Monitor crash reporting telemetry for repeated faults in is_qf_win() or adjacent quickfix functions.

Monitoring Recommendations

Forward endpoint process crash events and core dumps to a central SIEM for correlation with file-open activity.
Track package management events on Fedora 37, 38, and 39 hosts to confirm the patched vim package is installed.
Audit shared file repositories and code review pipelines for .vimrc or modeline content originating from untrusted sources.

How to Mitigate CVE-2023-4750

Immediate Actions Required

Upgrade Vim to version 9.0.1857 or later on all systems where the editor is installed.
Apply vendor updates on Fedora 37, 38, and 39 by installing the announced vim security packages.
Install the Apple security update referenced in Apple Support HT213984 on affected macOS systems.
Restrict opening of untrusted files in Vim until the patch is deployed.

Patch Information

The fix is published in Vim commit fc68299d436cf87453e432daa77b6d545df4d7ed and shipped as patch 9.0.1857. Distribution-specific updates are available through the Fedora package announcement and the Huntr bounty report.

Workarounds

Disable autocommands when opening untrusted files using vim -u NONE or vim --noplugin.
Set set noautocmd in environments where users must interact with files of unknown provenance.
Disable modeline processing with set nomodeline to limit attacker control over editor state.

bash

# Verify installed Vim version and apply distribution updates
vim --version | head -1

# Fedora
sudo dnf upgrade --refresh vim-common vim-enhanced vim-minimal

# macOS (system Vim is updated via OS security updates)
softwareupdate --install --all

# Temporary hardening when opening unknown files
vim -u NONE --noplugin -c 'set nomodeline noautocmd' suspicious_file.txt