Skip to content
OpenAdvisories
High RLSA-2026:66366 8 CVEs

Important: vim security update

Published Sep 11, 2026 · Updated Sep 11, 2026

Ecosystem: Rocky Linux

Summary

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)

* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 vim 2:8.2.2637-26.el9_8.21

Vulnerabilities 8

  • High 8.6
    CVE-2026-73078

    Vim: Arbitrary Code Execution via Netrw Menu Construction

    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled dire…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 8.5
    CVE-2026-73072 Public exploit

    Vim: Heap Buffer Overflow when Loading a Spell File

    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes und…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2026-73076

    Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2026-73077

    Vim: Arbitrary Code Execution via Shell Keyword Lookup

    Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.9
    CVE-2026-52859

    Vim: Out-of-bounds Read in Terminal Screen Snapshot

    Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 5.6
    CVE-2026-59857

    Vim: Out-of-bounds Write in SAL Soundfolding

    Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are gu…

    vim vim vim vim Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-55892

    Vim: Out-of-bounds Write in Spell File Prefix Dump

    Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 4.4
    CVE-2026-28420

    Vim has Heap-based Buffer Overflow and OOB Read in :terminal

    Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2443484
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487989
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492975
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498863
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514034
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514037
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514058
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514065
  • advisory
    https://access.redhat.com/errata/RHSA-2026:66366