CVE-2026-51400

Summary

A local attacker can execute arbitrary code by exploiting the vms_fixfilename() function in Vim versions up to 9.2.0389, allowing for remote code execution.

Exploitability

Exploitation requires local access to the system running Vim 9.2.0389 or earlier, making it moderately easy to exploit.

Blast radius

If exploited, the attacker could gain full control over the affected system, leading to potential data loss or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Vim version 9.2.0390 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.