Technical impact
The flaw exists within the Vim text editor’s vms_fixfilename() routine in os_vms.c. It allows a local attacker who can run Vim to execute arbitrary code, effectively compromising the execution environment of the vulnerable instance. The vulnerability is a classic code injection scenario that can grant an attacker full control over the system process running Vim.
Affected Systems
All Vim Project releases up to and including version 9.2.0389 are affected. Versions newer than 9.2.0389 have been updated to fix the issue. The vulnerability applies to any system running Vim where os_vms.c is compiled and used.
Risk and Exploitability
EPSS indicates a probability of exploitation that is less than 1%, reflecting a very low likelihood of being exploited in the wild. The CVSS score of 7.7 classifies this vulnerability as High, indicating significant potential for arbitrary code execution. The vulnerability is not listed in CISA KEV, with no documented public exploit. It is inferred that the attack vector is local, requiring user access that can launch Vim and trigger the vulnerable function. Given the impact, the severity is High.
