Vim CVE-2026-59858

Exploitation requires that the victim open a .c file from an attacker-controlled project whose accompanying ctags tags file contains a crafted entry with a malicious typeref: or typename: extension field, AND that the victim invoke Vim's C omni-completion (Ctrl-X Ctrl-O) on a symbol resolved through that entry; only Vim versions prior to 9.2.0735 are affected. Limiting factors are significant: the attack is local (AV:L) with no network reach, it needs active user interaction (UI:A) - the user must both open the hostile file and trigger completion - and it is confined to C omni-completion using a project tags file, so users who never run omni-completion or who use trusted, self-generated tags files are not exposed. No authentication is required (PR:N), and it works against default Vim configurations that have C omni-completion available.

The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, score 8.4) is internally consistent with the description: exploitation is local (the victim must open a file), requires no privileges, but does require active user interaction (opening the hostile .c file and invoking C omni-completion). The high VC/VI/VA ratings are justified because the injected command runs as the user and can read, modify, or destroy anything that user can. Countervailing signals lower the practical urgency: no POC is identified, there is no CISA KEV listing, and EPSS data was not provided, so no exploitation-probability signal is available. The realistic risk is meaningful but constrained - it depends on a social-engineering step (getting a developer to open a malicious C project with a poisoned tags file and run completion), which is why the vector uses UI:A rather than being a remote drive-by. This is a credible developer-workstation supply-chain-style threat rather than a mass-exploitable network vulnerability. No key signals conflict, but the absence of EPSS and POC data means widespread automated exploitation cannot be assessed from the available inputs.

An attacker publishes a seemingly legitimate C project (for example on a public repository) that includes a tags file whose typeref: or typename: field contains a bar followed by an Ex command such as one that spawns a shell. A developer clones the project, opens one of its .c files in a vulnerable Vim, and presses Ctrl-X Ctrl-O to complete a symbol, at which point the injected Ex command executes with the developer's privileges. No public POC is currently identified, and the local attack vector plus required user interaction mean the attacker must lure the victim into opening the project and using completion.