Skip to content
OpenAdvisories
High ELSA-2026-98119 1 CVE

Important: vim security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 11, 2026 · Updated Nov 11, 2026

Ecosystem: Oracle Linux

Summary

[8.0.1763-34.0.1]
- Remove upstream references [Orabug: 31197557]
- Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984]

[2:8.0.1763-34]
- RHEL-285535 CVE-2026-43961 vim: Vimscript injection via unescaped
filename in netrw s:NetrwMarkFile() filter() expression allows
arbitrary code execution

[2:8.0.1763-33]
- Fix backupcopy=auto writing in place by setting probe file permissions

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 8 vim-common 2:8.0.1763-34.0.1.el8_10
Oracle Linux · 8 vim-enhanced 2:8.0.1763-34.0.1.el8_10
Oracle Linux · 8 vim-filesystem 2:8.0.1763-34.0.1.el8_10
Oracle Linux · 8 vim-minimal 2:8.0.1763-34.0.1.el8_10
Oracle Linux · 8 vim-X11 2:8.0.1763-34.0.1.el8_10

Vulnerabilities 1

  • High 7.8
    CVE-2026-43961

    Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

    A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comma…

    Red Hat vim Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Alpine