CVE-2026-51401CWE-94code-injection

CVE-2026-51401

High · published August 5, 2026

CVSS v3.1

7.7

EPSS

Percentile

9.6

In the wild

Unconfirmed

What it is

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

The record

Technical detail

CVSS v3.1: 7.7 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00202 · 9.6th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2026-08-05T01:16Z

Affected products (1)

Product	Versions	Fixed in
vim/vim	≤ 9.2.0389	—

References (3)

https://gist.github.com/jiejiaodedengdai/ff5d34a523167e09b7d8330cc9f5d4e5#file-vim-os_vms-cves-md · [email protected]https://github.com/vim/vim · [email protected]https://github.com/vim/vim/blob/master/src/os_vms.c · [email protected]

EPSS history

Timeline

04 AUG 00:00Z
An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
cvelistv5