Subject: Re: CVE-2025-66476

From: Junio C Hamano <[email-masked]>
Date: Thu, 22 Jan 2026 10:09:29 -0800

Luis Alvarado <[email-masked]> writes:

> I need some help or guidance on how to remediate this vulnerability.
> We have a customer with Git, which includes VIM and is vulnerable to
> CVE-2025-66476. However, the GIT version for Windows was last updated
> in November 2025. How can I remediate this issue, is there a way to
> update VIM without updating git? if so , how.

The Git project does not ship any binary, not even Git binary, let
alone Vim binary.  We work on and ship only the source code of Git.

If you are getting your vim as part of the windows port of Git,
please redirect your inquiry to the Git for Windows project; you can
probably reach out to them at their issue tracker at

    https://github.com/git-for-windows/git/issues.

Please be sure to search first before asking, since the maintainer
of the project is busy.

Thanks.