oss-security - [vim-security] heap use-after-free was found in Vim

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <aJijevEkuGrUVYAK@256bit.org>
Date: Sun, 10 Aug 2025 15:49:46 +0200
From: Christian Brabandt <cb@...bit.org>
To: oss-security@...ts.openwall.com
Subject: [vim-security] heap use-after-free was found in Vim < 9.1.1400

Note: I have been asked to created a security advisory for the issue 
mentioned below. The actual issue has already been fixed on May 21st.

A heap use-after-free was found in Vim >v9.1.1231 and < 9.1.1400
================================================================
Date: 10.08.2025
Severity: Medium
CVE: *not yet assigned*
CWE: Use-after-free (CWE-416)

Vim gained support for the "tuple" data type in patch v9.1.1232.

When processing nested tuples in Vim script, an error during evaluation
can trigger a use-after-free in Vim’s internal tuple reference
management. Specifically, the tuple_unref() function may access already
freed memory due to improper lifetime handling, leading to memory
corruption.

While the most likely outcome is a denial-of-service (application
crash), the underlying memory corruption could, in theory, be leveraged
for more severe consequences depending on the environment in which Vim
is running. The exploit requires direct user interaction, as the script
must be explicitly executed within Vim and therefore the severity of
this impact is rated **medium**.

This issue was discovered via fuzz testing with AFL++ and confirmed
using AddressSanitizer.

The Vim project would like to thank Yang Luo and Yanju Chen from the
Security Team @ Riema Labs for reporting this issue and Yegappan
Lakshmanan for fixing this vulnerability.

The issue has been fixed as of Vim patch v9.1.1400

References:
https://github.com/vim/vim/commit/1307743697bbc46e1518abfea7f89caa95bcaf97
https://github.com/vim/vim/security/advisories/GHSA-3r4f-mm4w-wgg6

Thanks,
Chris
-- 
Manchen gibt man das Gefühl, wodurch man es andern nimmt, durch
Schlüsse.
		-- Jean Paul

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.