This advisory addresses four distinct security vulnerabilities in Vim: CVE-2026-46483 (command injection during .tgz archive decompression), CVE-2026-47162 (arbitrary code execution via crafted directory names), CVE-2026-52858 (arbitrary code execution via Python omni-completion), and CVE-2026-47167 (arbitrary code execution via crafted step-definition patterns). These vulnerabilities could allow an attacker to execute arbitrary code on affected systems. Red Hat has released updated Vim packages for Red Hat Enterprise Linux 8 and its extended life cycle variants to remediate these issues. The advisory references detailed CVE pages for further information and provides links to updated RPM packages for multiple architectures including x86_64, s390x, ppc64le, and aarch64.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution on affected systems running vulnerable versions of Vim. This could allow attackers to execute malicious commands or code with the privileges of the user running Vim. The vulnerabilities affect multiple attack vectors including archive decompression, directory name handling, Python omni-completion, and step-definition pattern processing. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Vim packages for Red Hat Enterprise Linux 8 and its extended life cycle versions to address these vulnerabilities. Users should apply the security update as soon as possible by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). The vendor advisory confirms the availability of an official fix. No additional mitigation steps are indicated beyond applying the provided update.