Vim versions older than 9.2.0272 can execute arbitrary code as soon as an attacker opens a specially crafted file. The flaw arises from an unescaped %{expr} injection in the tabpanel configuration when the P_MLE flag is absent, allowing shell commands to be evaluated in the user’s environment. If exploited, the attacker achieves full code execution under the current user’s privileges, compromising the session and potentially the underlying system.

Affected systems include all installations of the Vim editor built for Linux, macOS, and Windows prior to version 9.2.0272. The vulnerability applies to the default configuration; no special build flags are required. Users running any of these versions and opening files from untrusted sources are at risk.

The CVSS score of 9.2 categorizes this vulnerability as critical. An EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation is local: the victim must open the crafted file; no network or privilege escalation mechanism is required beyond that. Because the injected command runs with the current process’s privileges, a local attacker can gain full control of the system once the file is opened, making it a high‑risk threat for unpatched users.