Red Hat Security Advisory: vim security update

Fixed packages 4

Vulnerabilities 8

• High 8.6
  CVE-2026-73078

  Vim: Arbitrary Code Execution via Netrw Menu Construction

  Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled dire…

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Aug 11, 2026
• High 8.5
  CVE-2026-73072 Public exploit

  Vim: Heap Buffer Overflow when Loading a Spell File

  Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes und…

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Aug 11, 2026
• High 8.4
  CVE-2026-73076

  Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

  Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes …

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Aug 11, 2026
• High 8.4
  CVE-2026-73077

  Vim: Arbitrary Code Execution via Shell Keyword Lookup

  Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without…

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Aug 11, 2026
• Medium 6.9
  CVE-2026-52859

  Vim: Out-of-bounds Read in Terminal Screen Snapshot

  Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars…

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Jun 11, 2026
• Medium 5.6
  CVE-2026-59857

  Vim: Out-of-bounds Write in SAL Soundfolding

  Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are gu…

  vim vim vim vim Debian Ubuntu Alpine
  Jul 9, 2026
• Medium 5.5
  CVE-2026-55892

  Vim: Out-of-bounds Write in Spell File Prefix Dump

  Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the…

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Jun 25, 2026
• Medium 4.4
  CVE-2026-28420

  Vim has Heap-based Buffer Overflow and OOB Read in :terminal

  Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9…

  vim vim vim vim Debian Ubuntu Azure Linux Alpine
  Feb 27, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2443484
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2487989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492975
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498863
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514034
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514058
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514065
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66366.json
• report
  https://access.redhat.com/security/cve/CVE-2026-28420
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28420
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28420
• article
  https://github.com/vim/vim/commit/bb6de2105b160e729c34063
• article
  https://github.com/vim/vim/releases/tag/v9.2.0076
• article
  https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg
• report
  https://access.redhat.com/security/cve/CVE-2026-52859
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52859
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52859
• article
  https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19
• article
  https://github.com/vim/vim/releases/tag/v9.2.0565
• article
  https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm
• report
  https://access.redhat.com/security/cve/CVE-2026-55892
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55892
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55892
• article
  https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241f
• article
  https://github.com/vim/vim/releases/tag/v9.2.0662
• article
  https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
• report
  https://access.redhat.com/security/cve/CVE-2026-59857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59857
• article
  https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30
• article
  https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2
• report
  https://access.redhat.com/security/cve/CVE-2026-73072
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-73072
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-73072
• article
  https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a
• article
  https://github.com/vim/vim/releases/tag/v9.2.0846
• article
  https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64