EUVD-2025-200373Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Impact | CVSS score of 7.8 (HIGH). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.
Earlier versions of this analysis (1)
RemediationAI
A vendor patch is available. Apply it as soon as possible and verify the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Uncontrolled Search Path Element (CWE-427).
Know when Vim gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2Executive ViewAI
Vim on Windows systems prior to version 9.1.1947 is vulnerable to arbitrary code execution through malicious executables placed in the same directory as edited files. This affects any Windows user who edits files in untrusted directories (downloads, shared folders, project repositories), potentially allowing attackers to execute malware when Vim performs standard operations like grep, make, or external filters.
Apply vendor patch. If immediate patching is not feasible: (1) Configure Windows execution policies to prevent script execution from current directory; (2) Restrict user permissions to prevent placing executables in shared working directories; (3) Educate users to avoid editing files from untrusted sources in Vim; (4) Use application whitelisting to control Vim's spawned processes; (5) Disable cmd.exe as Vim shell if operationally feasible, switching to alternative shells that do not search current directory first.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | not-affected | debian: Only affects Vim on Windows |
| bionic | not-affected | windows only |
| focal | not-affected | windows only |
| jammy | not-affected | windows only |
| noble | not-affected | windows only |
| plucky | not-affected | windows only |
| questing | not-affected | windows only |
| trusty | not-affected | windows only |
| xenial | not-affected | windows only |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2:8.2.2434-3+deb11u1 | - |
| bullseye (security) | fixed | 2:8.2.2434-3+deb11u3 | - |
| bookworm | fixed | 2:9.0.1378-2+deb12u2 | - |
| trixie | fixed | 2:9.1.1230-2 | - |
| forky | fixed | 2:9.1.2141-1 | - |
| sid | fixed | 2:9.2.0136-1 | - |
| (unstable) | not-affected | - | - |
Exploit-DB