RHSA-2026:66366HighCVSS 8.8

Red Hat Security Advisory: vim security update

Published
September 10, 2026
Last Modified
September 17, 2026

🔗 CVE IDs covered (8)

CVE-2026-55892 →CVE-2026-59857 →CVE-2026-73072 →CVE-2026-73076 →CVE-2026-73077 →CVE-2026-73078 →CVE-2026-28420 →CVE-2026-52859 →

📋 Description

CVE-2026-28420 — vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-52859 — vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-55892 — vim: Vim: Denial of Service via crafted spell file CVE-2026-59857 — vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding CVE-2026-73072 — vim: Vim: Heap buffer overflow allows arbitrary code execution CVE-2026-73076 — vim: Vim: Arbitrary command execution via crafted vimball CVE-2026-73077 — vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling CVE-2026-73078 — vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

🎯 Affected products68

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-2:8.2.2637-26.el9_8.21.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-X11-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-2:8.2.2637-26.el9_8.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-2:8.2.2637-26.el9_8.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-X11-debuginfo-2:8.2.2637-26.el9_8.21.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-common-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-2:8.2.2637-26.el9_8.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-2:8.2.2637-26.el9_8.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-common-debuginfo-2:8.2.2637-26.el9_8.21.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-debuginfo-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • vim-debuginfo-2:8.2.2637-26.el9_8.21.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • vim-debuginfo-2:8.2.2637-26.el9_8.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +38 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Users should exercise caution when opening untrusted files or executing untrusted programs within vim's `:terminal` window. Avoiding interaction with untrusted content in this context can prevent the exploitation of this vulnerability, which leads to a denial of service. Workaround: Do not load untrusted spell files (.spl) from unknown sources. Avoid using :spelldump with spell files of unknown provenance. Workaround: This vulnerability can be mitigated by preventing Vim from automatically applying editor configurations embedded in files. Add the following line to the global /etc/vimrc or local ~/.vimrc configuration file: set nomodeline Workaround: If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim’s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened. Workaround: Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins. Workaround: To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory: - `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=` - `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=` - `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=` This change takes effect the next time a shell script is opened in Vim. Workaround: To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.

🔗 References (11)