Heap Buffer Overflow in Vim Project

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: MITRE

Description

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-51400

Affected Vendors & Products

Vendor	Product	Version / Range
vim_project	vim	to 9.2.0389 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a local code execution flaw in Vim Project version 9.2.0389 and earlier. It occurs due to an issue in the vms_fixfilename() function within the file vim/src/os_vms.c, allowing a local attacker to run arbitrary code on the affected system.

Impact Analysis

If exploited, this vulnerability could let an attacker execute malicious code on your system. This may lead to unauthorized access, data theft, or further compromise of the affected machine.

Mitigation Strategies

Update Vim to a version later than v9.2.0389 to remove the vulnerable code path. If updating is not immediately possible, restrict access to the vulnerable system and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-51400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70