# CVE-2026-51401: Vim vms_fixfilename NULL pointer dereference

Source: https://junglewise.ai/threats/cve-2026-51401-vim-vms-fixfilename-null-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-51401 · Severity: high · CVSS 7.7 · Published 2026-08-04

Vim is a widely-used text editor. A flaw in the vms_fixfilename() function on VMS systems can cause the editor to crash when handling filenames under low-memory conditions. A local attacker can trigger this crash, disrupting editing sessions and automated workflows.

Technologies: [Vim](https://junglewise.ai/threats/technologies/vim). Vendors: [Vim](https://junglewise.ai/threats/vendors/vim).

## Quick answers

**Is CVE-2026-51401 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51401 being exploited in the wild.

**How severe is CVE-2026-51401?** High severity, with a CVSS score of 7.7, published 4 August 2026.

**Which products and versions are affected?** Vim v9.2.0389 and earlier.

**Is there a fix for CVE-2026-51401?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51401 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-51401?** Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-51401 is a NULL pointer dereference (CWE-476) in the vms_fixfilename() function within vim/src/os_vms.c. The vulnerable function calls vim_realloc() without validating the returned pointer; when memory allocation fails under low-memory conditions, a NULL pointer is dereferenced during string operations, immediately crashing the process. This vulnerability affects Vim v9.2.0389 and earlier on VMS systems. Local attackers can trigger this denial-of-service condition through standard file and path handling operations. No patch status is explicitly stated in the advisory.

## Affected products

- Vim Vim v9.2.0389 and earlier

## Timeline

- 2026-08-04: disclosed

## References

- [https://gist.github.com/jiejiaodedengdai/ff5d34a523167e09b7d8330cc9f5d4e5](https://gist.github.com/jiejiaodedengdai/ff5d34a523167e09b7d8330cc9f5d4e5)
- [https://github.com/vim/vim](https://github.com/vim/vim)

## Related threats

- [Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim…](https://junglewise.ai/threats/cve-2026-73073-vim-is-an-open-source-command-line-text-editor-prior-to-9-2-0845)
- [Vim netrw code injection via menu construction](https://junglewise.ai/threats/cve-2026-73078-vim-netrw-code-injection-via-menu-construction)
- [Vim shell filetype plugin OS command injection via keyword lookup](https://junglewise.ai/threats/cve-2026-73077-vim-shell-filetype-plugin-os-command-injection-via-keyword-lookup)
- [Vim vimball arbitrary command execution via .VimballRecord](https://junglewise.ai/threats/cve-2026-73076-vim-vimball-arbitrary-command-execution-via-vimballrecord)
- [Vim out-of-bounds access in popup opacity handling](https://junglewise.ai/threats/cve-2026-73075-vim-out-of-bounds-access-in-popup-opacity-handling)