This vulnerability affects Vim Project versions up to and including 9.2.0389. It arises from a flaw in the vms_fixfilename() function within vim/src/os_vms.c, enabling a local attacker to execute arbitrary code. The CVSS 3.1 base score is 7.7, indicating high severity, with attack vector local, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). There are no known exploits in the wild and no vendor advisory or patch information currently available.

Successful exploitation allows a local attacker to execute arbitrary code on the affected system, potentially compromising confidentiality and integrity of the system. The attack does not require privileges or user interaction, increasing its risk in local attack scenarios. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to Vim usage. Avoid running untrusted code or scripts that could trigger this vulnerability.