This advisory covers four distinct vulnerabilities in Vim affecting Red Hat Enterprise Linux 8.8 variants: CVE-2026-25749 allows arbitrary code execution via the 'helpfile' option processing; CVE-2026-28417 enables arbitrary code execution through OS command injection in the netrw plugin; CVE-2026-28421 causes denial of service and information disclosure via crafted swap files; and CVE-2026-33412 permits arbitrary code execution via command injection in the glob() function. Red Hat has released updated Vim packages (version 8.0.1763-20.el8_8.1) to address these issues. The advisory classifies the security impact as Important and recommends applying the update to affected systems. No CVSS scores are provided in the advisory, but the presence of multiple arbitrary code execution vulnerabilities indicates a high severity threat.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on affected systems, potentially leading to full system compromise. Additionally, crafted swap files may cause denial of service or leak sensitive information. These vulnerabilities affect the Vim editor, a widely used text editor on Red Hat Enterprise Linux 8.8, increasing the risk to systems that use Vim for editing or processing files.

Red Hat has released updated Vim packages that address these vulnerabilities. Users should apply the security update RHSA-2026:6736 promptly to affected Red Hat Enterprise Linux 8.8 systems. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as an official fix provided by Red Hat.