The vulnerability resides in Vim's runtime/autoload/vimball.vim and permits a malicious vimball archive to include a specially named .VimballRecord file. When vimball#RmVimball() processes this record, it writes stored Ex commands, including those that invoke operating‑system commands via :!, to the installation record. Those commands then execute with the privileges of the user running Vim, providing an arbitrary command execution vector. The problem is classified under CWE‑78 (OS Command Injection), CWE‑829 (Excessive Privileges), and CWE‑94 (Code Injection).

All installations of the Vim editor distributed by the vim vendor, any version older than 9.2.0847, are affected. This includes the community and enterprise builds of Vim. No other vendors or products are listed as impacted.

The CVSS score of 8.4 indicates high severity while the EPSS score of less than 1% suggests a very low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The probable attack vector is local: an attacker must give a user a crafted vimball archive containing a malicious .VimballRecord entry, and the victim must open the archive or allow Vim to process it. If successful, the attacker can execute arbitrary shell commands with the user's privileges.