Red Hat Security Advisory

RHSA-2026:57614

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-08-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images vim-2:9.2.967-1.1.hum1@src, vim-X11-2:9.2.967-1.1.hum1@aarch64, vim-X11-2:9.2.967-1.1.hum1@x86_64 +14

Fixes 17 records

TI-2026-27204 CVE-2026-34982

Vim modeline bypass via various options affects Vim < 9.2.0276

LOW 38

Vim is an open source, command line text editor.

CVSS 3.1HIGH 8.2 Local No auth User interaction EPSS 0.00456 Published 2026-04-06 Partial fix · 9.2.0276 CWE-78

TI-2026-37964 CVE-2026-52859

Vim: Out-of-bounds Read in Terminal Screen Snapshot

LOW 36

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00303 Published 2026-06-11 Partial fix · 9.2.0565 CWE-125

TI-2026-32008 CVE-2026-43961

Code injection in vim

LOW 35

A flaw was found in Vim's netrw plugin.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00159 Published 2026-08-19 Partial fix · 9.2.0480, 9.2.967-1.1.hum1 CWE-94

TI-2026-28760 CVE-2026-39881

Vim Ex command injection in Vims NetBeans integration

LOW 35

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00644 Published 2026-04-08 Partial fix · 9.2.0316 CWE-94

TI-2026-37965 CVE-2026-52860

Vim: Arbitrary Code Execution via Python Omni-Completion

LOW 34

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.00224 Published 2026-06-11 Partial fix · 9.2.0597 CWE-94

TI-2026-34752 CVE-2026-47162

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

LOW 34

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00275 Published 2026-06-11 Partial fix · 9.2.0495 CWE-74

TI-2026-41385 CVE-2026-57453

Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction

LOW 33

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.3 Local No auth User interaction EPSS 0.00208 Published 2026-06-25 Fixed in 9.2.0678 CWE-77

TI-2026-37963 CVE-2026-52858

Vim: Arbitrary Code Execution via Python Omni-Completion

LOW 33

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00201 Published 2026-06-11 Partial fix · 9.2.0561 CWE-829

TI-2026-51280 CVE-2026-73073

Vim: Arbitrary Ex Command Execution in C Omni-Completion

LOW 32

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.00152 Published 2026-08-18 Partial fix · 9.2.0845 CWE-829

TI-2026-34183 CVE-2026-46483

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

LOW 32

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.00552 Published 2026-05-15 Fixed in 9.2.479 CWE-78

TI-2026-30011 CVE-2026-41411

Vim: Command injection via backtick expansion in tag filenames

LOW 32

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.6 Local No auth User interaction EPSS 0.00501 Published 2026-04-24 Fixed in 9.2.0357 CWE-78

TI-2026-27331 CVE-2026-35177

Path traversal issue with zip.vim in Vim

LOW 30

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00131 Published 2026-04-06 Partial fix · 9.2.0280 CWE-22

TI-2026-41386 CVE-2026-57454

Vim: Out-of-bounds Read with Text Properties

LOW 29

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00169 Published 2026-06-25 Fixed in 9.2.0679 CWE-125

TI-2026-32963 CVE-2026-45130

Vim: Heap Buffer Overflow in spell file loading

LOW 29

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.6 Local No auth User interaction EPSS 0.00248 Published 2026-05-08 Partial fix · 9.2.0450 CWE-122

TI-2026-41383 CVE-2026-57451

Vim: Out-of-bounds Read in Text Property Count

LOW 26

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00161 Published 2026-06-25 Partial fix · 9.2.0670 CWE-125

TI-2026-34757 CVE-2026-47167

Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

LOW 24

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00135 Published 2026-06-11 Partial fix · 9.2.0496 CWE-94

TI-2026-32556 CVE-2026-44656

Vim: OS Command Injection via 'path' completion

LOW 23

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 4.6 Local No auth User interaction EPSS 0.00917 Published 2026-05-08 Partial fix · 9.2.0435 CWE-78