CVE-2026-51401: 
Vim vulnerability analysis and mitigation

CVE-2026-51401 is a NULL pointer dereference vulnerability in Vim Project v9.2.0389 and earlier that allows a local attacker to execute arbitrary code via the vms_fixfilename() function within vim/src/os_vms.c. The vulnerability was discovered by XiJie Ao of B429 Laboratory, School of Cyber Science and Engineering, Wuhan University, and was published on August 4, 2026. It carries a CVSS v3.1 base score of 7.7 (High), assigned by CISA-ADP (Github Advisory, Security Advisory Gist).

Note: There is a discrepancy between the official CVE description (which states "arbitrary code execution") and the researcher's own security advisory, which classifies CVE-2026-51401 as a NULL pointer dereference (CWE-476) causing denial of service — not code execution. The NVD and CISA-ADP have assigned CWE-94 (Code Injection). Readers should be aware of this inconsistency when assessing risk.

According to the researcher's security advisory, CVE-2026-51401 is rooted in a NULL pointer dereference (CWE-476): the vms_fixfilename() function in vim/src/os_vms.c calls vim_realloc() to resize an internal buffer but does not validate the returned pointer before using it for string operations (Security Advisory Gist). When memory allocation fails under low-memory conditions, a NULL pointer is returned and immediately dereferenced, causing a program crash. CISA-ADP has additionally classified this as CWE-94 (Improper Control of Generation of Code / Code Injection), suggesting the possibility that crafted filenames could influence code generation paths in the VMS-specific filename translation logic (Github Advisory). The attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), with low attack complexity (AC:L). Exploitation is triggered through standard file and path handling operations on systems running Vim compiled for VMS environments.

Successful exploitation can result in high confidentiality and integrity impact with no availability impact per the CVSS scoring, though the researcher's advisory characterizes the primary consequence as a denial of service via program crash when memory allocation fails (Security Advisory Gist). If the code injection classification (CWE-94) is accurate, a local attacker could potentially execute arbitrary code in the context of the Vim process by manipulating filename inputs processed by vms_fixfilename(). The vulnerability is limited to systems where Vim is compiled with VMS support (os_vms.c), which restricts the affected population primarily to OpenVMS environments (Github Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (Github Advisory). CISA's SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable (Security Advisory Gist). The EPSS score is approximately 0.139% (4th percentile), reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Users should update Vim to a version after v9.2.0389 to remediate this vulnerability (Github Advisory). As an interim measure, restricting local access to systems running vulnerable Vim versions until patching is complete is advisable. Since the vulnerability is specific to the VMS port (os_vms.c), systems not running Vim on OpenVMS are not affected and do not require action. Red Hat has tracked this issue via Bugzilla for potential impact on their products (Red Hat Bugzilla).

The vulnerability was reported with limited community attention, receiving no stars or forks on the researcher's disclosure gist (Security Advisory Gist). Red Hat has opened a Bugzilla tracking entry to assess impact on their distributions (Red Hat Bugzilla). No significant vendor statements, researcher commentary, or media coverage beyond standard CVE aggregator reporting has been observed.