Vim EUVD-2026-19426

The CVSS vector (AV:L/AC:H/PR:N/UI:R/S:C) indicates this is a local-only attack requiring high complexity and user interaction (opening a crafted ZIP file), which substantially limits real-world exploitability. The CVSS score of 4.1 reflects low-to-moderate severity with limited integrity and availability impact. While the attack vector is local and authentication is not required, the high attack complexity and mandatory user interaction make opportunistic exploitation unlikely. This is not a critical vulnerability despite the path traversal nature; it requires a user to explicitly open a malicious ZIP file in Vim. However, for users who regularly process untrusted archives or work in environments where such files are common, this remains a valid concern. The fact that this bypasses a previously issued fix (CVE-2025-53906) suggests the original remediation was incomplete, which may warrant elevated priority in patch management workflows.

An attacker creates a specially crafted ZIP archive containing files with path traversal sequences designed to bypass Vim's directory restrictions (for example, entries that extract to '../../../etc/vim/vimrc' or similar locations). The attacker distributes this archive to a target user (via email, file sharing, or other means). When the victim opens the archive in Vim using the zip.vim plugin, the insufficient path validation allows the malicious files to be written to arbitrary filesystem locations, potentially overwriting configuration files, scripts, or other sensitive files accessible to the user running Vim. No public exploit code has been identified for this specific bypass at the time of analysis.