RHSA-2026:38509HighCVSS 7.3

Red Hat Security Advisory: vim security update

Published
July 13, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (4)

CVE-2026-47162 →CVE-2026-47167 →CVE-2026-52858 →CVE-2026-46483 →

📋 Description

CVE-2026-46483 — vim: command injection when decompressing .tgz archives CVE-2026-47162 — vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47167 — vim: Vim: Arbitrary code execution via crafted step-definition patterns CVE-2026-52858 — vim: Vim: Arbitrary code execution via Python omni-completion

🎯 Affected products73

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-2:9.1.083-9.el10_2.7.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-X11-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-2:9.1.083-9.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-2:9.1.083-9.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-2:9.1.083-9.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-X11-debuginfo-2:9.1.083-9.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-common-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-common-2:9.1.083-9.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-common-2:9.1.083-9.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-common-2:9.1.083-9.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-data-2:9.1.083-9.el10_2.7.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-debuginfo-2:9.1.083-9.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • vim-debugsource-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • vim-debugsource-2:9.1.083-9.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • +43 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead. Workaround: To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns. Workaround: Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.

🔗 References (5)