Skip to main content

Vim CVE-2026-51400

| EUVDEUVD-2026-52971 HIGH
Memory Leak (CWE-401)
2026-08-04 mitre GHSA-c4x9-mpg2-r897
RCE N A
8.4
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access to an OpenVMS login required (PR:L); memory-leak-to-RCE chain is inherently high-complexity (AC:H), not AC:L as originally scored.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 05, 2026 - 18:24 vuln.today
CVSS changed
Aug 05, 2026 - 18:22 NVD
8.4 (HIGH)
CVE Published
Aug 04, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 04, 2026 - 00:00 cve.org
HIGH 8.4

DescriptionCVE.org

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

AnalysisAI

Arbitrary code execution affects Vim v9.2.0389 and earlier through a memory management flaw in the OpenVMS-specific vms_fixfilename() function in vim/src/os_vms.c. A local attacker on an OpenVMS system can trigger this CWE-401 condition to achieve full code execution with high confidentiality, integrity, and availability impact. No public exploit confirmed at time of analysis, and the extremely low EPSS score (0.15%, 4th percentile) combined with the platform-specific attack surface indicates minimal real-world exploitation risk.

Technical ContextAI

The vulnerability resides in os_vms.c, a platform-specific source file implementing OpenVMS filesystem support for the Vim text editor. The affected function vms_fixfilename() handles filename canonicalization on the VMS operating system (OpenVMS, originally from DEC/Compaq/HP/VSI). CWE-401 ('Missing Release of Memory after Effective Lifetime') classifies this as a memory leak - allocated memory is not properly freed. While memory leaks most directly cause resource exhaustion, certain patterns involving use-after-free or heap layout manipulation can be exploited for code execution, though this path is significantly more complex than direct buffer overflows. The CPE data provided is non-informative (cpe:2.3:a:n/a:n/a), and no official vendor CPE string is available. The vulnerability is exclusive to Vim installations on OpenVMS; standard Linux/macOS/Windows Vim builds do not compile os_vms.c.

RemediationAI

Upgrade Vim to a version beyond 9.2.0389 once a patched release is issued by the Vim project; no vendor-released patched version is independently confirmed at the time of this analysis - the only reference is a researcher GitHub gist, not an official Vim advisory or tagged release. Organizations running Vim on OpenVMS should monitor the upstream Vim repository and the Vim project mailing list for a fix. As a compensating control, restrict interactive and scripted access to OpenVMS systems running the affected Vim version by limiting local login accounts and applying OpenVMS access control lists (ACLs) to prevent untrusted users from invoking Vim in contexts that process externally supplied filenames. Because the vulnerability is in a VMS-specific filename-handling routine, avoiding use of Vim for processing untrusted or externally sourced file paths on OpenVMS reduces exposure until a patch is available.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

Share

CVE-2026-51400 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy