SB2026070979 - openEuler 24.03 LTS SP3 update for vim
Published: July 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-55693)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the tree_count_words() function in src/spellfile.c when parsing a crafted .spl/.sug spell file pair during spell suggestion loading. A remote attacker can supply a specially crafted spell file pair to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must invoke spell suggestion on a misspelled word.
2) Out-of-bounds write (CVE-ID: CVE-2026-55892)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the dump_prefixes() function in src/spell.c when parsing a crafted .spl spell file during word list dumping. A remote attacker can supply a crafted spell file to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must dump the word list, such as via :spelldump or spelling completion.
3) Code Injection (CVE-ID: CVE-2026-55895)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in s:NetrwLocalRmFile() in the netrw plugin when deleting a local file from the browser using a crafted filename from the directory listing. A remote attacker can place a file with a crafted name containing Ex command separators and trick the victim into deleting that entry to execute arbitrary code.
User interaction is required to delete the specific crafted file entry, and exploitation is limited to environments where filenames may contain the bar character.
Remediation
Install update from vendor's website.