Skip to content
OpenAdvisories
High RHSA-2026:57614 17 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 12, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 vim 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-common 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-data 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-default-editor 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-enhanced 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-filesystem 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-minimal 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 vim-X11 2:9.2.967-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 xxd 2:9.2.967-1.1.hum1

Vulnerabilities 17

  • High 8.2
    CVE-2026-34982

    Vim modeline bypass via various options affects Vim < 9.2.0276

    Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_M…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 7.8
    CVE-2026-43961

    Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

    A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comma…

    Red Hat vim Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-52860

    Vim: Arbitrary Code Execution via Python Omni-Completion

    Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluate…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 7.3
    CVE-2026-47162

    Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

    Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths …

    vim vim vim vim Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2026-52858

    Vim: Arbitrary Code Execution via Python Omni-Completion

    Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) exec…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-73073

    Vim: Arbitrary Ex Command Execution in C Omni-Completion

    Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an untermina…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.9
    CVE-2026-52859

    Vim: Out-of-bounds Read in Terminal Screen Snapshot

    Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.8
    CVE-2026-57454

    Vim: Out-of-bounds Read with Text Properties

    Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts …

    vim vim vim vim Debian Azure Linux Alpine
  • Medium 6.6
    CVE-2026-41411

    Vim: Command injection via backtick expansion in tag filenames

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-45130

    Vim: Heap Buffer Overflow in spell file loading

    Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spe…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-57453

    Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction

    Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inser…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-57451

    Vim: Out-of-bounds Read in Text Property Count

    Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a …

    vim vim vim vim Debian Azure Linux Alpine
  • Medium 5.1
    CVE-2026-47167

    Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

    Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read …

    vim vim vim vim Debian Ubuntu Azure Linux
  • Medium 5.0
    CVE-2026-39881

    Vim Ex command injection in Vims NetBeans integration

    Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defin…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 4.6
    CVE-2026-44656 Public exploit

    Vim: OS Command Injection via 'path' completion

    Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 4.1
    CVE-2026-35177

    Path traversal issue with zip.vim in Vim

    Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vuln…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Low 3.6
    CVE-2026-46483

    Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

    Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d comman…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-73073
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-57451
  • report
    https://access.redhat.com/security/cve/CVE-2026-57453
  • report
    https://access.redhat.com/security/cve/CVE-2026-57454
  • report
    https://access.redhat.com/security/cve/CVE-2026-52860
  • report
    https://access.redhat.com/security/cve/CVE-2026-52858
  • report
    https://access.redhat.com/security/cve/CVE-2026-52859
  • report
    https://access.redhat.com/security/cve/CVE-2026-47167
  • report
    https://access.redhat.com/security/cve/CVE-2026-47162
  • report
    https://access.redhat.com/security/cve/CVE-2026-46483
  • report
    https://access.redhat.com/security/cve/CVE-2026-45130
  • report
    https://access.redhat.com/security/cve/CVE-2026-44656
  • report
    https://access.redhat.com/security/cve/CVE-2026-43961
  • report
    https://access.redhat.com/security/cve/CVE-2026-41411
  • report
    https://access.redhat.com/security/cve/CVE-2026-35177
  • report
    https://access.redhat.com/security/cve/CVE-2026-34982
  • report
    https://access.redhat.com/security/cve/CVE-2026-39881
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57614.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455400
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34982
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34982
  • article
    http://www.openwall.com/lists/oss-security/2026/04/01/1
  • article
    https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615
  • article
    https://github.com/vim/vim/releases/tag/v9.2.0276
  • article
    https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455542
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-35177
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-35177
  • article
    https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456722
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-39881
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-39881
  • article
    https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19
  • article
    https://github.com/vim/vim/releases/tag/v9.2.0316
  • article
    https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461614
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41411