CVE-2026-51401: Vim Project RCE Vulnerability

CVE-2026-51401 Overview

CVE-2026-51401 is a local code execution vulnerability affecting Vim Project version 9.2.0389 and earlier. The flaw resides in the vms_fixfilename() function inside vim/src/os_vms.c, which is the OpenVMS platform support code for the Vim editor. A local attacker can leverage this weakness to execute arbitrary code in the context of the Vim process. The issue maps to CWE-94: Improper Control of Generation of Code, indicating a code injection class weakness rather than a memory-safety bug alone.

Critical Impact
Local attackers can execute arbitrary code through the Vim OpenVMS filename handling routine, compromising confidentiality and integrity on affected systems.

Affected Products

Vim Project version 9.2.0389 and earlier (OpenVMS builds)
The vim/src/os_vms.c module implementing vms_fixfilename()
Downstream distributions and packages bundling vulnerable Vim releases

Discovery Timeline

2026-08-04 - CVE-2026-51401 published to the National Vulnerability Database
2026-08-05 - Last updated in the NVD database

Technical Details for CVE-2026-51401

Vulnerability Analysis

The vulnerability exists in vms_fixfilename(), a helper routine that normalizes and translates filenames for OpenVMS conventions. Improper control over generated code or command constructs in this routine allows attacker-influenced filename input to be processed in a way that leads to arbitrary code execution. Because the exploit path is local, the attacker must already have access to the system or induce a target user to open a crafted file or path with Vim. Successful exploitation yields high impact to confidentiality and integrity, while availability remains unaffected according to the CVSS vector.

Root Cause

The root cause is classified under [CWE-94]. The vms_fixfilename() function does not properly validate or sanitize filename components before they are used in operations that construct or interpret code-like semantics on OpenVMS. Malformed input flows through the filename transformation logic and reaches a sink where it can influence execution.

Attack Vector

Exploitation requires local access and no authentication or user interaction beyond invoking Vim against attacker-controlled input. An attacker plants or supplies a filename that, when processed by vms_fixfilename(), triggers the code injection condition. Details of the affected code path are documented in the GitHub CVE list for VMS and the corresponding Vim source in os_vms.c.

No verified public proof-of-concept code has been released. Refer to the Vim repository for authoritative source and commit history.

Detection Methods for CVE-2026-51401

Indicators of Compromise

Unexpected child processes spawned from vim on OpenVMS hosts, particularly shells or command interpreters.
Vim invocations against files with unusual filename constructs containing OpenVMS-specific delimiters or embedded control sequences.
Modifications to user profile scripts or startup files shortly after Vim sessions on shared systems.

Detection Strategies

Inventory installed Vim versions across OpenVMS-capable hosts and flag any build at or below 9.2.0389.
Monitor process ancestry to catch anomalous descendants of the Vim binary consistent with code execution.
Alert on Vim opening files whose paths were recently written by low-privilege or untrusted users.

Monitoring Recommendations

Enable command-line and process-creation auditing on systems where Vim is used interactively.
Correlate file-creation events with subsequent Vim invocations to identify staged local exploitation attempts.
Track package inventory changes so Vim upgrades and downgrades are logged for compliance review.

How to Mitigate CVE-2026-51401

Immediate Actions Required

Upgrade Vim to a fixed release beyond version 9.2.0389 as soon as a patched build is available from the Vim project.
Restrict interactive Vim usage on multi-user OpenVMS systems to trusted accounts until patching is complete.
Audit which users can write files into directories that administrators or higher-privileged users routinely open with Vim.

Patch Information

The upstream fix is tracked in the Vim source repository. Administrators should follow the project's release notes for the commit that hardens vms_fixfilename() in src/os_vms.c and rebuild or update packages accordingly. Distribution maintainers should pull the corrected source and rebuild OpenVMS-targeted binaries.

Workarounds

Avoid opening untrusted filenames or files from untrusted directories with Vim on OpenVMS builds.
Where feasible, use an alternative editor for files supplied by untrusted local users until the patch is applied.
Apply filesystem permissions that prevent low-privileged users from staging files in paths consumed by privileged Vim sessions.

bash

# Verify installed Vim version and flag vulnerable builds
vim --version | head -n 1
# Expected remediation: version string above 9.2.0389 with the os_vms.c fix applied