This advisory covers four distinct security vulnerabilities in Vim on Red Hat Enterprise Linux 10.0 EUS and related variants: CVE-2026-25749 (arbitrary code execution via 'helpfile' option processing), CVE-2026-28417 (arbitrary code execution via OS command injection in the netrw plugin), CVE-2026-28421 (denial of service and information disclosure via crafted swap file), and CVE-2026-33412 (arbitrary code execution via command injection in the glob() function). These vulnerabilities allow an attacker to execute arbitrary code or cause denial of service under certain conditions. Red Hat has released updated Vim packages that fix these issues. The advisory references multiple bugzilla entries corresponding to each CVE and provides package details for remediation.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on affected systems or cause denial of service and information disclosure. This could compromise system integrity and confidentiality. The vulnerabilities affect multiple components of Vim, including option processing, plugins, and file handling. No known exploits are reported in the wild, but the potential impact is significant given the nature of arbitrary code execution.

Red Hat has released updated Vim packages addressing these vulnerabilities as part of advisory RHSA-2026:6502. Users should apply the official security updates for Vim provided by Red Hat for their specific platform and architecture. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an on-premises product, system administrators must manually apply these patches. There are no indications that the vulnerabilities are already mitigated or require no action.