The error occurs within Vim’s C omni‑completion script that interpolates the typeref: or typename: extension field of a tags entry into a :vimgrep pattern without proper escaping. Because the pattern is then executed by Vim’s :execute command, a maliciously crafted tags entry can terminate the search pattern and append an arbitrary Ex command. When a user with editing privileges opens a .c file whose project tags file contains such a malicious entry and invokes C omni‑completion, Vim executes that injected Ex command as the editing user, resulting in arbitrary code execution.

All versions of Vim older than 9.2.0735 are affected, including release series 9.1.x and earlier as well as the current 9.2 branch before patch u0735. Systems that use the default C omni‑completion routine and load project tags files containing untrusted entries are vulnerable.

The CVSS score of 8.4 indicates a high severity vulnerability. However, the EPSS score of <1% indicates a very low exploitation probability. The issue is not listed in CISA’s KEV catalog. The attack vector is local, requiring an attacker to provide a malicious tags file to a user who opens a .c source file and triggers C omni‑completion. Once executed entire system.