Red Hat Security Advisory

RHSA-2026:69128

vim security update

Released 2026-09-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) vim-2:7.4.629-5.el6_10.4, vim-X11-2:7.4.629-5.el6_10.4, vim-common-2:7.4.629-5.el6_10.4 +2

Fixes 13 records

TI-2026-22691 CVE-2026-28417

Vim has OS Command Injection in netrw

LOW 39

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01353 Published 2026-02-27 Fixed in 9.2.0073 CWE-86

TI-2026-27204 CVE-2026-34982

Vim modeline bypass via various options affects Vim < 9.2.0276

LOW 38

Vim is an open source, command line text editor.

CVSS 3.1HIGH 8.2 Local No auth User interaction EPSS 0.00456 Published 2026-04-06 Partial fix · 9.2.0276 CWE-78

TI-2026-42673 CVE-2026-59858

Vim: Arbitrary Code Execution via C Omni-Completion

LOW 37

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00137 Published 2026-07-09 Partial fix · 9.2.0735 CWE-94

TI-2026-41388 CVE-2026-57456

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

LOW 37

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00145 Published 2026-06-25 Fixed in 9.2.0699 CWE-94

TI-2026-22695 CVE-2026-28421

Vim has a heap-buffer-overflow and a segmentation fault

LOW 35

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00206 Published 2026-02-27 Fixed in 9.2.0077 CWE-122

TI-2026-34752 CVE-2026-47162

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

LOW 34

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00275 Published 2026-06-11 Partial fix · 9.2.0495 CWE-74

TI-2026-37963 CVE-2026-52858

Vim: Arbitrary Code Execution via Python Omni-Completion

LOW 33

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00201 Published 2026-06-11 Partial fix · 9.2.0561 CWE-829

TI-2026-34183 CVE-2026-46483

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

LOW 32

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.00552 Published 2026-05-15 Fixed in 9.2.479 CWE-78

TI-2026-30011 CVE-2026-41411

Vim: Command injection via backtick expansion in tag filenames

LOW 32

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.6 Local No auth User interaction EPSS 0.00501 Published 2026-04-24 Fixed in 9.2.0357 CWE-78

TI-2026-27331 CVE-2026-35177

Path traversal issue with zip.vim in Vim

LOW 30

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00131 Published 2026-04-06 Partial fix · 9.2.0280 CWE-22

TI-2026-40208 CVE-2026-55693

Vim: Out-of-bounds Write in Spell File Word Count

LOW 26

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 5.7 Local No auth User interaction EPSS 0.00124 Published 2026-06-25 Partial fix · 9.2.0653 CWE-787

TI-2026-34757 CVE-2026-47167

Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

LOW 24

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00135 Published 2026-06-11 Partial fix · 9.2.0496 CWE-94

TI-2026-41387 CVE-2026-57455

Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

LOW 20

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 4.0 Local No auth User interaction EPSS 0.00118 Published 2026-06-25 Partial fix · 9.2.0698 CWE-787