Several virtualization repositories provide Vista images for testing. These expire after 90 days and require a legitimate key to continue.
(extended support ended April 11, 2017). However, it remains proprietary software. You should only download a QCOW2 image if: Windows Vista Qcow2 Download