High-Severity Vim for Windows Flaw (CVE-2025-66476) Risks Arbitrary Code Execution from Compromised Folders

Vim for Windows has a high-severity flaw, CVE-2025-66476, that could allow arbitrary code execution simply by opening a file in a compromised directory. The vulnerability has a CVSS score of 7.8 and stems from the way Vim prioritises the local folder over the system’s safe paths when interacting with the command shell. According to security advisory, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file.

The issue can be triggered when Vim invokes external tools such as findstr for grep, via :!, or during make/compiler commands, enabling a trojanised binary to run under the user’s privileges. Affected versions are Vim for Windows 9.1.1946 and earlier, with a fix in 9.1.1947, and the author recommends Windows users update their Vim installation promptly to prevent inadvertent code execution from untrusted project folders.

The vulnerability was reported by Simon Zuckerbraun of Trend Micro’s Zero Day Initiative, and the Vim maintainers have moved quickly to close the loophole.