This advisory covers four distinct vulnerabilities in Vim: CVE-2026-25749 allows arbitrary code execution via processing of the 'helpfile' option; CVE-2026-28417 involves arbitrary code execution through OS command injection in the netrw plugin; CVE-2026-28421 enables denial of service and information disclosure via crafted swap files; and CVE-2026-33412 permits arbitrary code execution through command injection in the glob() function. These vulnerabilities affect multiple architectures and versions of Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat has released updated Vim packages to address these security issues as detailed in advisory RHSA-2026:6539. The advisory classifies the impact as important (high severity).

The vulnerabilities allow an attacker to execute arbitrary code on affected systems, potentially leading to full system compromise, or cause denial of service and information disclosure. The affected Vim editor versions are widely used in Red Hat Enterprise Linux 9.6 Extended Update Support environments. No known active exploitation has been reported. The impact severity is high due to the possibility of arbitrary code execution and information leakage.

Red Hat has released updated Vim packages that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:6539 and the referenced article https://access.redhat.com/articles/11258. Since this is an on-premises product, system administrators must manually update affected packages to remediate the issues. There is no indication that no action is required or that the issues are already mitigated without patching.