CVE-2026-51401: Vim vms_fixfilename NULL pointer dereference

Executive brief

Vim is a widely-used text editor. A flaw in the vms_fixfilename() function on VMS systems can cause the editor to crash when handling filenames under low-memory conditions. A local attacker can trigger this crash, disrupting editing sessions and automated workflows.

Technical details

CVE-2026-51401 is a NULL pointer dereference (CWE-476) in the vms_fixfilename() function within vim/src/os_vms.c. The vulnerable function calls vim_realloc() without validating the returned pointer; when memory allocation fails under low-memory conditions, a NULL pointer is dereferenced during string operations, immediately crashing the process. This vulnerability affects Vim v9.2.0389 and earlier on VMS systems. Local attackers can trigger this denial-of-service condition through standard file and path handling operations. No patch status is explicitly stated in the advisory.

Affected products

• Vim Vim v9.2.0389 and earlier

Timeline

• 2026-08-04: disclosed

References

• https://gist.github.com/jiejiaodedengdai/ff5d34a523167e09b7d8330cc9f5d4e5
• https://github.com/vim/vim