Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-04T00:00:00 vim: Vim: Arbitrary code execution via vms_fixfilename() function 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-94

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

A flaw was found in Vim. A local attacker can exploit improper handling of filenames within the `vms_fixfilename()` function to achieve arbitrary code execution. This vulnerability enables a local user to escalate privileges or impact system integrity.

This Moderate Vim vulnerability allows local arbitrary code execution due to improper filename handling in vms_fixfilename(). Red Hat products are unaffected because the vulnerable code is absent from Red Hat's supported packages. Red Hat Enterprise Linux 10 Not affected vim Red Hat Enterprise Linux 6 Not affected vim Red Hat Enterprise Linux 7 Not affected vim Red Hat Enterprise Linux 8 Not affected vim Red Hat Enterprise Linux 9 Not affected vim Red Hat Hardened Images Not affected vim Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-51400 https://nvd.nist.gov/vuln/detail/CVE-2026-51400 https://gist.github.com/jiejiaodedengdai/ff5d34a523167e09b7d8330cc9f5d4e5#file-vim-os_vms-cves-md