Read the docs
TI-2010-03719 Aliases CVE-2010-3914GHSA-v5pg-9f9w-5m2q

Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and…

Priority MEDIUM 52Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file. NOTE: some of these details are obtained from third party information.

Why it matters now

EPSS 0.0909 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:vim:gvim:*:*:*:*:*:*:*:*up to 7.3.033Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.01:*:*:*:*:*:*:*7.3.01Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.02:*:*:*:*:*:*:*7.3.02Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.03:*:*:*:*:*:*:*7.3.03Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.04:*:*:*:*:*:*:*7.3.04Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.05:*:*:*:*:*:*:*7.3.05Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.06:*:*:*:*:*:*:*7.3.06Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.07:*:*:*:*:*:*:*7.3.07Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.08:*:*:*:*:*:*:*7.3.08Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.09:*:*:*:*:*:*:*7.3.09Vulnerablevim
  • cpe:2.3:a:vim:gvim:*:*:*:*:*:*:*:* Versions up to 7.3.033 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.01:*:*:*:*:*:*:* Versions 7.3.01 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.02:*:*:*:*:*:*:* Versions 7.3.02 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.03:*:*:*:*:*:*:* Versions 7.3.03 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.04:*:*:*:*:*:*:* Versions 7.3.04 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.05:*:*:*:*:*:*:* Versions 7.3.05 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.06:*:*:*:*:*:*:* Versions 7.3.06 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.07:*:*:*:*:*:*:* Versions 7.3.07 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.08:*:*:*:*:*:*:* Versions 7.3.08 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.09:*:*:*:*:*:*:* Versions 7.3.09 Vulnerable ·vim
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vim:gvim:7.3.010:*:*:*:*:*:*:*7.3.010Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.011:*:*:*:*:*:*:*7.3.011Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.012:*:*:*:*:*:*:*7.3.012Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.013:*:*:*:*:*:*:*7.3.013Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.014:*:*:*:*:*:*:*7.3.014Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.015:*:*:*:*:*:*:*7.3.015Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.016:*:*:*:*:*:*:*7.3.016Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.017:*:*:*:*:*:*:*7.3.017Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.018:*:*:*:*:*:*:*7.3.018Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.019:*:*:*:*:*:*:*7.3.019Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.020:*:*:*:*:*:*:*7.3.020Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.021:*:*:*:*:*:*:*7.3.021Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.022:*:*:*:*:*:*:*7.3.022Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.023:*:*:*:*:*:*:*7.3.023Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.024:*:*:*:*:*:*:*7.3.024Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.025:*:*:*:*:*:*:*7.3.025Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.026:*:*:*:*:*:*:*7.3.026Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.027:*:*:*:*:*:*:*7.3.027Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.028:*:*:*:*:*:*:*7.3.028Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.029:*:*:*:*:*:*:*7.3.029Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.030:*:*:*:*:*:*:*7.3.030Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.031:*:*:*:*:*:*:*7.3.031Vulnerablevim
cpe:2.3:a:vim:gvim:7.3.032:*:*:*:*:*:*:*7.3.032Vulnerablevim
  • cpe:2.3:a:vim:gvim:7.3.010:*:*:*:*:*:*:* Versions 7.3.010 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.011:*:*:*:*:*:*:* Versions 7.3.011 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.012:*:*:*:*:*:*:* Versions 7.3.012 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.013:*:*:*:*:*:*:* Versions 7.3.013 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.014:*:*:*:*:*:*:* Versions 7.3.014 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.015:*:*:*:*:*:*:* Versions 7.3.015 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.016:*:*:*:*:*:*:* Versions 7.3.016 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.017:*:*:*:*:*:*:* Versions 7.3.017 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.018:*:*:*:*:*:*:* Versions 7.3.018 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.019:*:*:*:*:*:*:* Versions 7.3.019 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.020:*:*:*:*:*:*:* Versions 7.3.020 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.021:*:*:*:*:*:*:* Versions 7.3.021 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.022:*:*:*:*:*:*:* Versions 7.3.022 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.023:*:*:*:*:*:*:* Versions 7.3.023 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.024:*:*:*:*:*:*:* Versions 7.3.024 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.025:*:*:*:*:*:*:* Versions 7.3.025 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.026:*:*:*:*:*:*:* Versions 7.3.026 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.027:*:*:*:*:*:*:* Versions 7.3.027 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.028:*:*:*:*:*:*:* Versions 7.3.028 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.029:*:*:*:*:*:*:* Versions 7.3.029 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.030:*:*:*:*:*:*:* Versions 7.3.030 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.031:*:*:*:*:*:*:* Versions 7.3.031 Vulnerable ·vim
  • cpe:2.3:a:vim:gvim:7.3.032:*:*:*:*:*:*:* Versions 7.3.032 Vulnerable ·vim

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3914
  2. 2026-10-03 Alias added: GHSA-v5pg-9f9w-5m2q

References

Patch 1

Advisory 1

  • TI-2022-17326 An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences