CVE-2026-51401

Summary

A local attacker can exploit a vulnerability in Vim Project versions up to 9.2.0389 to execute arbitrary code, due to an issue in the vms_fixfilename() function.

Exploitability

Exploitation requires local access and knowledge of the specific input to trigger the vulnerability. The attacker must have write permissions to the file system.

Blast radius

If exploited, the attacker could gain full control over the affected system, leading to data loss, system compromise, and potential propagation of the exploit to other systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Vim Project version 9.2.0390 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.