CVE-2026-33412 is a vulnerability in the glob() function of Vim (Vi IMproved) that permits arbitrary code execution through command injection. This flaw affects the vim package version 7.4.629-5.el6_10.3 distributed with Red Hat Enterprise Linux Server Extended Life Cycle Support Extension 6. Red Hat Product Security has issued an advisory (RHSA-2026:6725) describing the vulnerability and providing updated packages to remediate the issue. The vulnerability is classified under CWE-78, indicating improper neutralization of special elements in OS commands. No CVSS score is available from the advisory, but the issue is rated as having important security impact.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected systems via command injection in the glob() function of Vim. This could lead to unauthorized control or compromise of the system where the vulnerable Vim version is installed. The advisory rates the security impact as important (high severity).

Red Hat has released updated vim packages (version 7.4.629-5.el6_10.3) for Red Hat Enterprise Linux Server Extended Life Cycle Support Extension 6 to address this vulnerability. Users should apply these official updates promptly to remediate the issue. For detailed update instructions, refer to Red Hat's article at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.