RHSA-2026:68711HighCVSS 8.8

Red Hat Security Advisory: vim security update

Published
September 17, 2026
Last Modified
September 18, 2026

🔗 CVE IDs covered (14)

CVE-2026-46483 →CVE-2026-59858 →CVE-2026-73072 →CVE-2026-73076 →CVE-2026-35177 →CVE-2026-47162 →CVE-2026-47167 →CVE-2026-52858 →CVE-2026-55693 →CVE-2026-57455 →CVE-2026-57456 →CVE-2026-73078 →CVE-2026-34982 →CVE-2026-41411 →

📋 Description

CVE-2026-34982 — vim: arbitrary command execution via modeline sandbox bypass CVE-2026-35177 — vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass CVE-2026-41411 — vim: Vim: Command injection allows arbitrary code execution via malicious tag files CVE-2026-46483 — vim: command injection when decompressing .tgz archives CVE-2026-47162 — vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47167 — vim: Vim: Arbitrary code execution via crafted step-definition patterns CVE-2026-52858 — vim: Vim: Arbitrary code execution via Python omni-completion CVE-2026-55693 — vim: Vim: Out-of-bounds Write in Spell File Word Count CVE-2026-57455 — vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() CVE-2026-57456 — vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-59858 — vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73072 — vim: Vim: Heap buffer overflow allows arbitrary code execution CVE-2026-73076 — vim: Vim: Arbitrary command execution via crafted vimball CVE-2026-73078 — vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

🎯 Affected products26

  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-2:7.4.629-8.el7_9.2.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-X11-2:7.4.629-8.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-X11-2:7.4.629-8.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-X11-2:7.4.629-8.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-X11-2:7.4.629-8.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-common-2:7.4.629-8.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-common-2:7.4.629-8.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-common-2:7.4.629-8.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-common-2:7.4.629-8.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-debuginfo-2:7.4.629-8.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-debuginfo-2:7.4.629-8.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-debuginfo-2:7.4.629-8.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-debuginfo-2:7.4.629-8.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-enhanced-2:7.4.629-8.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-enhanced-2:7.4.629-8.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-enhanced-2:7.4.629-8.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-enhanced-2:7.4.629-8.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-filesystem-2:7.4.629-8.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-filesystem-2:7.4.629-8.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-filesystem-2:7.4.629-8.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-filesystem-2:7.4.629-8.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-minimal-2:7.4.629-8.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-minimal-2:7.4.629-8.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-minimal-2:7.4.629-8.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • vim-minimal-2:7.4.629-8.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file: ~~~ set nomodeline ~~~ Workaround: Avoid opening untrusted zip archives with Vim. This operational control prevents the necessary user interaction required to trigger the path traversal vulnerability in the `zip.vim` plugin. Workaround: Mitigation for this issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands. Workaround: To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead. Workaround: To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns. Workaround: Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim. Workaround: To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations. Workaround: To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect. Workaround: Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation. Workaround: If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim’s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened. Workaround: Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins. Workaround: To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.

🔗 References (17)