CVE-2026-51401

Summary

The flaw allows a local attacker to execute arbitrary code through the vms_fixfilename() function in Vim versions up to 9.2.0389, posing a significant security risk.

Exploitability

Exploitation requires access to the affected system and knowledge of the specific input to trigger the vulnerability; it is moderately difficult.

Blast radius

If exploited, this could lead to full compromise of the affected system, including data theft or manipulation.

Prioritized remediation

Update Vim to version 9.2.0390 or later to mitigate the risk.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.