Vim communicates with users on a VMS platform through its os_vms.c code, and within that source a function called vms_fixfilename() performs memory operations on file names. The vulnerability, associated with both CWE-401 (Memory Corruption) and CWE-94 (Improper Control of Generation of Code), is triggered when the function processes a specially crafted filename. The resulting memory corruption permits a local attacker to cause the Vim process to execute arbitrary instructions, effectively taking control of the editor with the current user’s privileges. Although the flaw originates from a local code path, the consequences are severe because a compromised editor can lead to system compromise or further lateral movement if the user has elevated rights.

The flaw is present in Vim Project versions up to and including 9.2.0389 that are built with VMS support enabled. Users running those builds on a VMS operating system—such as OpenVMS—are affected. The original description does not mention other vendors or platforms, and no other operating systems or vendor builds are known to contain the affected code path.

The attack vector is local; only a user who can launch Vim on the target VMS system can exploit this weakness. The flaw involves both memory corruption (CWE-401) and potentially code injection (CWE-94). The EPSS score is reported to be less than 1%, indicating a low current probability of exploitation. The CVSS score of 8.4 grades the vulnerability as high severity, reflecting the potential for arbitrary code execution with the attacker’s privileges. The vulnerability is not listed in the CISA KEV catalog, further underscoring its relatively low exploitation likelihood at present.