Vim for Windows Flaw Lets Attackers Execute Arbitrary Code
A high-security vulnerability has been identified in Vim for Windows, potentially enabling attackers to execute malicious code on compromised systems.
A high-security vulnerability has been identified in Vim for Windows, potentially enabling attackers to execute malicious code on compromised systems.
The flaw, designated as CVE-2025-66476, affects Vim versions prior to 9.1.1947 and has been classified with a high severity due to its significant risk to Windows users.
CVE ID: CVE-2025-66476 Product: Vim for Windows Severity: High CVSS Score: 7.8
The vulnerability originates from an uncontrolled search path issue on Windows systems. When Vim executes tasks requiring external commands, it searches for executable files in the current working directory before system paths, creating a potential for exploitation.
A high-security vulnerability has been identified in Vim for Windows, potentially enabling attackers to execute malicious code on compromised systems.
The attack scenario involves a user unknowingly opening a file from a maliciously cloned repository in Vim. If the repository includes a trojanized executable with a common name, such as findstr.exe, Vim may execute the malicious file instead of the legitimate system binary, granting the attacker code execution capabilities with the user's privileges.
Several Vim features can trigger this vulnerability, including the :grep command, external command execution via :! , filter commands, and build tool integrations using :make , as well as any Vim scripts utilizing the system() function.
Notably, the attack can be executed without administrative privileges, simply by opening a file in a compromised directory. This makes the vulnerability particularly dangerous, as arbitrary code execution is possible under normal user operations.
The Vim development team has resolved the issue in version 9.1.1947. Users are strongly advised to upgrade to this version or later to mitigate the vulnerability. The vulnerability was reported by Simon Zuckerbraun of Trend Micro's Zero Day Initiative, illustrating the potential for Vim to execute unauthorized commands.
Users are advised to exercise caution when handling files from untrusted sources and prioritize the security update to protect against potential exploitation.
Based on reporting by GBHackers.