RHSA-2026:72466HighCVSS 8.8

Red Hat Security Advisory: vim security update

Published
September 28, 2026
Last Modified
October 1, 2026

🔗 CVE IDs covered (12)

CVE-2026-73076 →CVE-2026-73077 →CVE-2026-73078 →CVE-2026-47167 →CVE-2026-52858 →CVE-2026-55693 →CVE-2026-59856 →CVE-2026-73072 →CVE-2026-47162 →CVE-2026-57455 →CVE-2026-57456 →CVE-2026-59858 →

📋 Description

CVE-2026-47162 — vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47167 — vim: Vim: Arbitrary code execution via crafted step-definition patterns CVE-2026-52858 — vim: Vim: Arbitrary code execution via Python omni-completion CVE-2026-55693 — vim: Vim: Out-of-bounds Write in Spell File Word Count CVE-2026-57455 — vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() CVE-2026-57456 — vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-59856 — vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion CVE-2026-59858 — vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73072 — vim: Vim: Heap buffer overflow allows arbitrary code execution CVE-2026-73076 — vim: Vim: Arbitrary command execution via crafted vimball CVE-2026-73077 — vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling CVE-2026-73078 — vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

🎯 Affected products68

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-2:8.2.2637-20.el9_2.3.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-X11-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-2:8.2.2637-20.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-2:8.2.2637-20.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-X11-debuginfo-2:8.2.2637-20.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-common-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-2:8.2.2637-20.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-2:8.2.2637-20.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-common-debuginfo-2:8.2.2637-20.el9_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-debuginfo-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • vim-debuginfo-2:8.2.2637-20.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • vim-debuginfo-2:8.2.2637-20.el9_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • +38 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns. Workaround: Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim. Workaround: To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations. Workaround: To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect. Workaround: Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect. Workaround: Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation. Workaround: If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim’s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened. Workaround: Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins. Workaround: To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory: - `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=` - `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=` - `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=` This change takes effect the next time a shell script is opened in Vim. Workaround: To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.

🔗 References (15)