This advisory covers three vulnerabilities in Vim affecting Red Hat Enterprise Linux 10 variants: CVE-2026-28417 allows arbitrary code execution via OS command injection in the netrw plugin; CVE-2026-28421 enables denial of service and information disclosure via crafted swap files; and CVE-2026-33412 permits arbitrary code execution through command injection in the glob() function. These issues stem from improper input handling leading to command injection and memory safety problems (CWE-78 and CWE-120). Red Hat has issued updated Vim packages to fix these vulnerabilities, with detailed instructions available in their advisory RHSA-2026:7711.

Successful exploitation of CVE-2026-28417 and CVE-2026-33412 could allow an attacker to execute arbitrary code on affected systems, potentially leading to full system compromise. CVE-2026-28421 could result in denial of service and unauthorized information disclosure. These vulnerabilities affect multiple architectures and editions of Red Hat Enterprise Linux 10. No known exploits in the wild have been reported at this time.

Red Hat has released updated Vim packages that address these vulnerabilities. Users should apply the security update for Vim as described in Red Hat advisory RHSA-2026:7711 and the related article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional vendor advisories indicate that no action is required or that these issues are already mitigated.