SB2026091011 - Red Hat Enterprise Linux 8 update for vim
Published: September 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-28420)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the handle_pushline() function in src/terminal.c processing maximum combining characters from Unicode supplementary planes. A remote attacker can trick the victim into copying a specially crafted string into the :terminal buffer, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Out-of-bounds read (CVE-ID: CVE-2026-52859)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the update_snapshot() function in src/terminal.c when processing terminal screen snapshots in a :terminal window. A local user can emit terminal output containing a cell with a base character and five combining marks to cause a denial of service.
The issue can be triggered when the user enters Terminal-Normal mode or when the terminal job exits.
3) Out-of-bounds write (CVE-ID: CVE-2026-55892)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the dump_prefixes() function in src/spell.c when parsing a crafted .spl spell file during word list dumping. A remote attacker can supply a crafted spell file to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must dump the word list, such as via :spelldump or spelling completion.
4) Out-of-bounds write (CVE-ID: CVE-2026-59857)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the SAL sound-folding logic in spell_soundfold_sal() when processing a boundary-length word through soundfold() with a SAL-based spell language active. A local user can supply a crafted boundary-length word to cause a denial of service.
The vulnerable path is only reached under a non-multibyte 8-bit encoding such as latin1, and spell checking must be enabled with a SAL-based language.
5) Code Injection (CVE-ID: CVE-2026-73076)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the Vimball record file. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Heap-based buffer overflow (CVE-ID: CVE-2026-73072)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error. A remote attacker can trick a victim to open a specially crafted spell file, trigger a heap-based buffer overflow and cause a denial of service on the target system.
7) Command injection (CVE-ID: CVE-2026-73078)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in netrw menu construction in runtime/pack/dist/opt/netrw/autoload/netrw.vim when rebuilding bookmarks, history, and targets menus from attacker-controlled directory paths. A remote attacker can supply a specially crafted directory path containing command separators or quotes to execute arbitrary code.
Exploitation requires the GUI version of Vim with the menu bar enabled, and user interaction to browse or bookmark the crafted path so it is recorded in netrw history or bookmarks and the menus are rebuilt.
Remediation
Install update from vendor's website.