This Red Hat security advisory addresses eight distinct vulnerabilities in Vim, an enhanced version of the vi editor. The issues include information disclosure and denial of service via crafted Unicode characters in terminal emulators (CVE-2026-28420), denial of service through out-of-bounds writes in terminal handling (CVE-2026-52859) and spell sound-folding (CVE-2026-59857), denial of service via crafted spell files (CVE-2026-55892), and multiple arbitrary code execution vulnerabilities via crafted vimball files (CVE-2026-73076), heap buffer overflow (CVE-2026-73072), crafted Netrw menu entries (CVE-2026-73078), and insecure shell command handling (CVE-2026-73077). These vulnerabilities collectively pose risks of information leakage, service disruption, and remote code execution. Red Hat has released updated Vim packages for Red Hat Enterprise Linux 10 to remediate these issues.

The vulnerabilities can lead to information disclosure, denial of service conditions, and arbitrary code execution on affected systems running vulnerable versions of Vim. Exploitation could allow attackers to crash the editor or execute arbitrary commands with the privileges of the user running Vim. This poses a significant risk to system confidentiality, availability, and integrity if exploited.

Red Hat has released security updates for Vim in Red Hat Enterprise Linux 10 to address these vulnerabilities. Users should apply the official Red Hat updates as described in the advisory RHSA-2026:66336 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will mitigate the identified security issues. No additional vendor-recommended mitigations are indicated.