This advisory covers four distinct vulnerabilities in Vim on Red Hat Enterprise Linux 8.4: CVE-2026-25749 allows arbitrary code execution through the 'helpfile' option processing; CVE-2026-28417 enables arbitrary code execution via OS command injection in the netrw plugin; CVE-2026-28421 causes denial of service and information disclosure through crafted swap files; and CVE-2026-33412 permits arbitrary code execution via command injection in the glob() function. These issues are rated as having an important security impact by Red Hat. Updated Vim packages have been released to address these vulnerabilities. The advisory references detailed CVE pages for further technical details and CVSS scoring. The affected products include Red Hat Enterprise Linux 8.4 AUS, EUS, and Extended Update Support variants. No cloud service is involved, and no known exploits have been reported.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on affected systems, cause denial of service, or disclose sensitive information. The vulnerabilities affect the Vim text editor in Red Hat Enterprise Linux 8.4 variants. The advisory rates the security impact as important (high severity). There are no reports of active exploitation in the wild at this time.

Red Hat has released updated Vim packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8.4 variants should apply the security update as detailed in Red Hat advisory RHSA-2026:6729 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. Patch status is confirmed as available from the vendor advisory.