Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This security update for Vim addresses several vulnerabilities: CVE-2026-73070 is a stack buffer overflow in the socket server that can cause denial of service; CVE-2026-73071 is a use-after-free in JSON decoding leading to process crashes; CVE-2026-73072 and CVE-2026-73074 are heap buffer overflows that may cause crashes or potential code execution; CVE-2026-73075 involves out-of-bounds access causing conditional memory writes; CVE-2026-73076, CVE-2026-73077, and CVE-2026-73078 allow arbitrary command or code execution via crafted vimball files, insecure shell command handling, or crafted netrw menu entries. The update to version 9.2.0957 fixes these issues. The vendor advisory from Red Hat confirms the availability of this update and provides package versions for remediation.

Exploitation of these vulnerabilities can result in denial of service through crashes or process termination, and in some cases, arbitrary code execution which could allow an attacker to execute malicious commands or code on the affected system. The severity is high due to the potential for code execution and system compromise.

A security update to Vim version 9.2.0957 is available and should be applied to remediate these vulnerabilities. The vendor advisory from Red Hat provides updated packages and instructions for applying the update. Users should upgrade to the fixed version as soon as possible. No additional mitigations or workarounds are specified in the advisory.