This advisory covers four distinct security vulnerabilities in Vim as packaged for Red Hat Enterprise Linux 8.6. CVE-2026-25749 involves arbitrary code execution via processing of the 'helpfile' option. CVE-2026-28417 is an arbitrary code execution vulnerability due to OS command injection in the netrw plugin. CVE-2026-28421 allows denial of service and information disclosure through crafted swap files. CVE-2026-33412 involves arbitrary code execution via command injection in the glob() function. Red Hat has released updated Vim packages addressing these issues in their 8.0.1763-19.el8_6.5 release. The advisory rates the security impact as Important (high severity) and provides detailed package updates for affected Red Hat Enterprise Linux 8.6 variants. No known exploits in the wild have been reported at the time of the advisory.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on affected systems, cause denial of service, or disclose sensitive information. The vulnerabilities affect the Vim editor, which is commonly used on Red Hat Enterprise Linux 8.6 systems. Arbitrary code execution vulnerabilities pose a high risk as they can lead to full system compromise. Denial of service and information disclosure vulnerabilities can disrupt system availability and leak sensitive data respectively. The overall security impact is rated as Important by Red Hat.

Red Hat has released updated Vim packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 8.6 variants should apply the updates referenced in advisory RHSA-2026:6731 promptly. The advisory provides detailed package names and versions for the fixes. No additional mitigation steps are indicated beyond applying the official patches. Patch status is confirmed as an official fix available from Red Hat. Refer to https://access.redhat.com/articles/11258 for update instructions.