This advisory covers four distinct vulnerabilities in Vim on Red Hat Enterprise Linux 9.4: CVE-2026-34982 allows arbitrary command execution via a modeline sandbox bypass; CVE-2026-35177 enables arbitrary file overwrite via path traversal in the zip.vim plugin; CVE-2026-41411 permits command injection through malicious tag files; and CVE-2026-46483 involves command injection during decompression of .tgz archives. These vulnerabilities can lead to arbitrary code execution or file overwrite, posing significant security risks. Red Hat has released updated Vim packages (version 8.2.2637-20.el9_4.3) that fix these issues. The advisory references detailed bugzilla entries and update instructions. No CVSS scores are provided, but the impact is rated as important/high by Red Hat.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary commands or code on the affected system, or overwrite arbitrary files, potentially leading to system compromise or data loss. The vulnerabilities affect the Vim editor and its zip.vim plugin, which are commonly used in Red Hat Enterprise Linux 9.4 environments. The impact is considered high due to the ability to execute arbitrary code and overwrite files.

Red Hat has released official security updates for Vim in Red Hat Enterprise Linux 9.4 that address these vulnerabilities. Users should apply the updates as detailed in the Red Hat advisory RHSA-2026:28049 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches. Patch status is confirmed as fixed in the updated Vim packages version 8.2.2637-20.el9_4.3.