Vulnerability in Microsoft Windows
CVE-2025-66476
Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (36.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Microsoft Windows
- Vim — versions < 9.1.1947
Weakness classification (CWE)
References
- github.com/vim/vim/security/advisories/GHSA-g77q-xrww-p834 (Patch, Vendor Advisory)
- github.com/vim/vim/commit/083ec6d9a3b7b09006e0ce69ac802597d25 (Patch)
- github.com/vim/vim/releases/tag/v9.1.1947 (Release Notes)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-66476?
- CVE-2025-66476 is a high-severity vulnerability in Microsoft Windows, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2025-12-02.
- How severe is CVE-2025-66476?
- High severity. CVSS v3 base score is 7.8 out of 10.