CVE-2026-51401
Publication date 4 August 2026
Last updated 11 August 2026
Ubuntu priority
Description
An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| vim | 26.04 LTS resolute |
Vulnerable, fix deferred
|
| 24.04 LTS noble |
Vulnerable, fix deferred
|
|
| 22.04 LTS jammy |
Vulnerable, fix deferred
|
|
| 20.04 LTS focal |
Vulnerable, fix deferred
|
|
| 18.04 LTS bionic |
Vulnerable, fix deferred
|
|
| 16.04 LTS xenial |
Vulnerable, fix deferred
|
|
| 14.04 LTS trusty |
Vulnerable, fix deferred
|
Notes
kkernick
This vulnerability appears to be AI-generated, with no fix in the specified release, and does not appear to have been disclosed to upstream.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.7 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N