Skip to main content

Vim CVE-2026-51401

| EUVDEUVD-2026-52970 HIGH
Code Injection (CWE-94)
2026-08-04 mitre GHSA-wv45-rxv4-pf47
RCE Code Injection N A
7.7
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.8 HIGH

OpenVMS local access requires at minimum a basic OS account (PR:L); arbitrary code execution warrants A:H, which the reported vector incorrectly omits.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Generated
Aug 05, 2026 - 20:23 vuln.today
CVSS changed
Aug 05, 2026 - 20:22 NVD
7.7 (HIGH)
CVE Published
Aug 04, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 04, 2026 - 00:00 cve.org
HIGH 7.7

DescriptionCVE.org

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

AnalysisAI

Arbitrary code injection in Vim 9.2.0389 and earlier exposes OpenVMS deployments to local code execution through a flaw in the platform-specific vms_fixfilename() function in os_vms.c. A local attacker can craft a malicious filename that bypasses sanitization controls in this VMS-only code path, causing Vim to execute injected code. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though a researcher's technical write-up is publicly accessible via GitHub Gist; the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability in practice.

Technical ContextAI

The vulnerable component is vms_fixfilename() in vim/src/os_vms.c, which is an OpenVMS-specific operating system abstraction layer responsible for normalizing and processing VMS-format filesystem paths and filenames. This source file is only compiled and executed when Vim runs on OpenVMS (VMS) platforms - Linux, macOS, and Windows Vim builds do not include this code path. CWE-94 (Improper Control of Generation of Code - Code Injection) identifies the root cause as insufficient validation or sanitization of filename input, allowing attacker-controlled data to influence code generation or execution flow within the function. The CVE references point directly to the upstream Vim GitHub repository and the specific source file, suggesting the vulnerability was identified through source code review rather than runtime fuzzing.

RemediationAI

The primary remediation is to upgrade Vim to a version later than 9.2.0389 that includes a fix for the vms_fixfilename() code injection flaw; however, no specific patched version has been confirmed in the available data. Organizations should monitor the Vim GitHub repository at https://github.com/vim/vim and track commits to src/os_vms.c for an upstream fix. As compensating controls for environments where an immediate upgrade is not possible, restrict local user access to OpenVMS hosts running Vim, apply the principle of least privilege so that only required accounts can invoke Vim, and avoid processing untrusted or externally supplied filenames through Vim on VMS systems. If OpenVMS instances are no longer operationally required, decommissioning them eliminates the attack surface entirely with no side effects. Organizations should note that no patch release has been independently confirmed, so version-specific upgrade guidance cannot be provided at this time.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

Share

CVE-2026-51401 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy