Red Hat issued a security advisory (RHSA-2026:35387) for Red Hat Hardened Images RPMs, including Vim packages version 9.2.780-1.hum1. The advisory addresses multiple CVEs, notably CVE-2026-57456, which involves a vulnerability in Vim's Python omni-completion feature. This vulnerability allows local attackers to execute arbitrary Python code by opening a malicious file and triggering omni-completion, due to improper handling of docstrings. The advisory lists affected Vim RPMs and recommends mitigation by disabling Python omni-completion or avoiding untrusted Python files. No explicit patch version or fixed version is provided in the advisory content, and the update is described as a bug fix and enhancement update.

The vulnerability allows local attackers to execute arbitrary code on systems running vulnerable Vim versions by exploiting the Python omni-completion feature with crafted files. This can lead to full system compromise where Vim is executed. The flaw impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild are reported. The severity is rated high by Red Hat.

Users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding 'autocmd FileType python setlocal omnifunc=' to the .vimrc file and restarting Vim. This prevents execution of the vulnerable code. The advisory does not explicitly confirm a fixed version or patch availability; therefore, users should monitor Red Hat's official channels for updates and apply the update when available.