Red Hat Product Security has released an important security update for Vim in Red Hat Enterprise Linux 9 to address four vulnerabilities: CVE-2026-46483 involves command injection during decompression of .tgz archives; CVE-2026-47162 allows arbitrary code execution via crafted directory names; CVE-2026-52858 enables arbitrary code execution through Python omni-completion; and CVE-2026-47167 permits arbitrary code execution via crafted step-definition patterns. These vulnerabilities could allow an attacker to execute arbitrary code on affected systems. The advisory provides updated Vim packages to remediate these issues. The update applies to multiple Red Hat Enterprise Linux 9 variants and architectures including x86_64, s390x, ppc64le, and aarch64. Detailed patch instructions are available from Red Hat's official advisory page.

The identified vulnerabilities in Vim could allow attackers to execute arbitrary code on affected systems. This includes command injection and arbitrary code execution through various vectors such as crafted archive decompression, directory names, Python omni-completion, and step-definition patterns. Successful exploitation could lead to full system compromise depending on the privileges of the user running Vim. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Vim packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 and its variants should apply the security update as soon as possible by following the instructions in the Red Hat advisory RHSA-2026:38511 (https://access.redhat.com/errata/RHSA-2026:38511). Applying this update will remediate the command injection and arbitrary code execution vulnerabilities. No additional mitigations are specified or required beyond applying the official update.