Is CVE-2026-57453 actively exploited?

No active exploitation of CVE-2026-57453 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-57453 be exploited remotely?

No. CVE-2026-57453 requires local access to exploit.

What is the CVSS score of CVE-2026-57453?

CVE-2026-57453 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-57453

HIGH

CVE-2026-57453

CWE-77Published: June 25, 2026· Updated: Jun 26, 2026

7.3

CVSS v3.1

EPSS:0.14%probability of exploitation in 30 daysPercentile:3.5th

Official Description

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.

NVD Source

Technical Analysis

CVE-2026-57453 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.3.