CVE-2026-51401 is a format string vulnerability in vms_fixfilename(), a function in Vim's VMS-specific code path (os_vms.c). The flaw allows a local attacker who can control filenames processed by Vim on OpenVMS to achieve arbitrary code execution through format string specifiers in the filename string passed to this function. The CVSS 3.1 base score of 7.7 reflects the technical severity, but the EPSS score of 0.00139 tells a different story: this vulnerability is extraordinarily unlikely to be exploited in practice.
The practical risk is near-zero not because the bug is minor, but because the attack surface is effectively dead. OpenVMS has a tiny installed base, fewer than a handful of people likely compile Vim for it, and the vms_fixfilename() code path is almost certainly untested and unfuzzed. This creates a situation where a legitimate high-severity vulnerability exists in code that receives no security scrutiny — not because it's secure, but because nobody is watching.
What you should do: apply the patch from Vim 9.1.x (or whichever version carries the fix). The patch is straightforward and fixes the format string issue directly. There is no evidence this is being exploited, and given the platform constraints, you are not at risk unless you are running Vim on an active OpenVMS system in an environment where untrusted filenames can be fed to Vim.
The deeper issue worth noting: low EPSS scores on platform-specific code create a permission structure where vulnerabilities accumulate without remediation. The patch will be issued, committed, and closed — but no one with a VMS system will validate it. This is not unique to Vim. Cross-platform projects routinely carry dead-code paths that receive no audit, and the CVE process treats them the same as actively maintained attack surfaces. For Vim specifically, the practical security posture is unchanged by this CVE: the VMS code was always high-risk due to neglect, and this one bug being found doesn't change that baseline. The question for maintainers is whether carrying platform-specific code you cannot validate is acceptable technical debt — and for users, whether it affects your builds at all (most Linux/Windows/macOS builds don't include VMS code).