We investigate the physical-layer security of a buffer-aided multiple-input multiple-output relay channel. The wireless network under investigation is composed of one legitimate source node (Alice), one legitimate half-duplex relay node, and one legitimate destination node (Bob). Alice communicates with both relay and Bob in the presence of a potential passive multi-antenna eavesdropper (Eve). Without knowing the instantaneous eavesdropper's channel state information at the legitimate nodes, we propose a precoded artificial-noise injection scheme to enhance the security of the legitimate transmissions. The relay is equipped with a finite buffer to store the unsuccessfully decoded packets at Bob. We analyze the Markov chain of the relay's queue and derive its steady-state distributions. Our optimization problem is formulated such that the average end-to-end secure throughput is maximized under the secrecy outage probability constraint on the Alice-relay link. Our numerical results demonstrate that our proposed buffer-aided relaying scheme achieves a significant improvement in the secure throughput compared with the conventional bufferless relaying scheme, where the time slot is divided equally between the source and the relay for their data transmissions.