HomeNetappCVE-2024-43374

CVE-2024-43374

MEDIUM
4.5CVSS
Published: 2024-08-16
Updated: 2025-08-25
AI Analysis

Description

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

CVSS Metrics

Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack Vector
local
Complexity
high
Privileges
none
User Action
required
Scope
unchanged
Confidentiality
low
Integrity
low
Availability
low
Weaknesses
CWE-416

Metadata

Primary Vendor
NETAPP
Published
8/16/2024
Last Modified
8/25/2025
Source
NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

netapp : bootstrap_osvim : vim

AI-Powered Remediation

Generate remediation guidance or a C-suite brief for this vulnerability.

Executive Intelligence Brief

CVE-CVE-2024-43374 | MEDIUM Severity | CVEDatabase.com | CVEDatabase.com