This Red Hat security advisory addresses four vulnerabilities in Vim versions shipped with Red Hat Enterprise Linux 8.2 AUS x86_64. The vulnerabilities include: (1) arbitrary code execution via processing of the 'helpfile' option (CVE-2026-25749), (2) arbitrary code execution through OS command injection in the netrw plugin (CVE-2026-28417), (3) denial of service and information disclosure via crafted swap files (CVE-2026-28421), and (4) arbitrary code execution through command injection in the glob() function (CVE-2026-33412). These issues stem from improper input handling leading to code execution or information leakage. Red Hat has released updated Vim packages to fix these issues as detailed in advisory RHSA-2026:6730. The advisory rates the impact as Important (high severity).

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on affected systems or cause denial of service and information disclosure. The arbitrary code execution vulnerabilities arise from improper input validation in Vim's 'helpfile' option processing, netrw plugin, and glob() function. The denial of service and information disclosure vulnerability involves crafted swap files. These impacts could compromise system integrity and confidentiality if exploited. However, no known exploits in the wild have been reported so far.

Red Hat has released updated Vim packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.2 AUS x86_64 should apply the security update provided in advisory RHSA-2026:6730 promptly. Details and instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory beyond applying the official patch.