CVE-2024-47814

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-478156.0IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site SCVE-2024-478166.4ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell whoCVE-2024-478176.1Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a coCVE-2024-478186.5Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on tCVE-2024-478198.7Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prioCVE-2024-47826.5A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dCVE-2024-478203.5MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8.CVE-2024-478212.3pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completeCVE-2024-478224.2Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are pCVE-2024-478239.8Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.1CVE-2024-478248.7matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0CVE-2024-478258.7Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions