CVE-2026-51400

vim: Vim: Arbitrary code execution via vms_fixfilename() function

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · August 4, 2026

Updated · August 31, 2026

Description

A flaw was found in Vim. A local attacker can exploit improper handling of filenames within the vms_fixfilename() function to achieve arbitrary code execution. This vulnerability enables a local user to escalate privileges or impact system integrity.

Statement

This Moderate Vim vulnerability allows local arbitrary code execution due to improper filename handling in vms_fixfilename(). Red Hat products are unaffected because the vulnerable code is absent from Red Hat's supported packages.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-94 · Improper Control of Generation of Code ('Code Injection')