CVE catalog

CVE-2025-66476

vim: CVE-2025-66476

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Dec 2, 2025, 9:49:24 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.45% · Oct 25, 2026

Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	vim	sid	`2:9.2.0858-1`	not affected
Debian	vim	forky	`2:9.2.0858-1`	not affected
Debian	vim	trixie	`2:9.1.1230-2`	not affected
Debian	vim	bookworm	`2:9.0.1378-2+deb12u2`	not affected
Cpe	vim	Not reported	`9.1.1947`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	vim	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	vim	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	vim	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	vim	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Cpe	vim	cpe	Not reported	`9.1.1947`	Not reported	NVD-CVE-2025-66476	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[vim]Not affected
Details (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-athena]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-common]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-doc]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-gtk3]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-gui-common]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-motif]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-nox]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-runtime]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Not affected
  dsa · vim · debian · bookworm
[vim-tiny]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
[xxd]Not affected
Source package: [vim]
Details (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · vim · debian · bookworm

Observed: Oct 24, 2026, 8:33:45 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]