CVE-2026-51401: Vim

High severity, CVSS 7.7. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

Affected products

• Vim Vim: up to and including 9.2.0389

Published 2026-08-04. Last modified 2026-09-04.