Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-04T00:00:00 vim: Vim: Arbitrary code execution via vms_fixfilename() function 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-641

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

A flaw was found in Vim. A local attacker could exploit a vulnerability in the `vms_fixfilename()` function, allowing them to execute arbitrary code on the system. This could lead to a complete compromise of the affected system.

Red Hat Enterprise Linux and Fedora build Vim against the POSIX/Linux platform layer (os_unix.c). The vulnerable function, vms_fixfilename(), is defined in os_vms.c, which provides OpenVMS-specific support and is never compiled into Red Hat's or Fedora's Vim packages. As a result, none of Red Hat's shipped Vim builds contain the affected code path. No mitigation is required. Red Hat does not ship any product containing the vulnerable code path - the affected function is confined to Vim's OpenVMS platform support, which is not included in Red Hat Enterprise Linux or Fedora builds. Red Hat Enterprise Linux 10 Not affected vim Red Hat Enterprise Linux 6 Not affected vim Red Hat Enterprise Linux 7 Not affected vim Red Hat Enterprise Linux 8 Not affected vim Red Hat Enterprise Linux 9 Not affected vim Red Hat Hardened Images Not affected vim Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-51401 https://nvd.nist.gov/vuln/detail/CVE-2026-51401 https://gist.github.com/jiejiaodedengdai/ff5d34a523167e09b7d8330cc9f5d4e5#file-vim-os_vms-cves-md https://github.com/vim/vim https://github.com/vim/vim/blob/master/src/os_vms.c