Red Hat Product Security released an advisory for multiple vulnerabilities in Vim editor in Red Hat Enterprise Linux 8. The security issues include CVE-2026-46483 (command injection during .tgz archive decompression), CVE-2026-47162 (arbitrary code execution via crafted directory names), CVE-2026-52858 (arbitrary code execution via Python omni-completion), and CVE-2026-47167 (arbitrary code execution via crafted step-definition patterns). These vulnerabilities allow potential arbitrary code execution under certain conditions. The advisory provides updated Vim packages for affected architectures and instructs users to apply these updates. No CVSS scores were provided in the advisory, but the overall impact is rated as important by Red Hat.

The vulnerabilities enable attackers to execute arbitrary code on systems running vulnerable versions of Vim, potentially compromising system integrity and security. The flaws include command injection and arbitrary code execution vectors triggered by crafted inputs such as archive files, directory names, Python omni-completion, and step-definition patterns. Successful exploitation could allow attackers to run malicious code with the privileges of the user running Vim.

Red Hat has released updated Vim packages addressing these vulnerabilities for Red Hat Enterprise Linux 8 on multiple architectures. Users should apply the security update as described in the Red Hat advisory (RHSA-2026:38510) and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional or alternative mitigations are indicated or required by the vendor.