SB2026080309 - Red Hat Enterprise Linux 9 update for vim
Published: August 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-57455)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the single-byte branch of spell_soundfold_sofo() in src/spell.c when processing an over-long word through SOFO sound-folding. A local user can supply a specially crafted over-long word to cause a denial of service.
The vulnerable path is only reached under a non-multibyte 8-bit encoding such as latin1, with spell checking enabled for a language that uses a SOFO sound-folding table.
2) Code Injection (CVE-ID: CVE-2026-57456)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in Python omni-completion docstring handling in runtime/autoload/python3complete.vim and pythoncomplete.vim when processing a hostile Python buffer during omni-completion. A remote attacker can craft a malicious docstring and convince a user to trigger Python omni-completion to execute arbitrary code.
User interaction is required to open or edit a hostile Python buffer and trigger Python omni-completion. Only builds with +python3 or +python support are affected.
3) Out-of-bounds write (CVE-ID: CVE-2026-55693)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the tree_count_words() function in src/spellfile.c when parsing a crafted .spl/.sug spell file pair during spell suggestion loading. A remote attacker can supply a specially crafted spell file pair to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must invoke spell suggestion on a misspelled word.
4) Code Injection (CVE-ID: CVE-2026-59856)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in runtime/autoload/phpcomplete.vim when processing a crafted PHP file during omni-completion. A remote attacker can trick the victim into opening a crafted file and invoking omni-completion to execute arbitrary code.
User interaction is required to open a crafted PHP file and manually invoke omni-completion, and exploitation requires filetype plugins to be enabled.
5) Code Injection (CVE-ID: CVE-2026-59858)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in the C omni-completion script in runtime/autoload/ccomplete.vim when processing type information from a tags entry during omni-completion. A local user can supply a crafted tags entry and trick the victim into invoking C omni-completion on a hostile .c file to execute arbitrary code.
User interaction is required to open a hostile .c file and invoke omni-completion on a structure-member access, and the issue is reachable only when filetype plugins are enabled and a reachable tags file is used.
Remediation
Install update from vendor's website.