Vim contains security flaws where it incorrectly processes marked filenames in the netrw plugin (CVE-2026-43961) and mishandles filenames when decompressing certain archives (CVE-2026-46483). These vulnerabilities could be exploited to achieve arbitrary code execution. Vendor advisories from Ubuntu and Red Hat confirm these issues and provide patched package versions. The Ubuntu advisory lists fixed package versions starting from vim 2:9.1.0016-1ubuntu7.15 and later, while Red Hat provides updates for vim 8.2.2637-20.el9_4.3 and related packages. The vulnerabilities are rated medium severity by Ubuntu and important by Red Hat. No known exploits are reported in the wild.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the affected system by leveraging improper filename handling in Vim's netrw plugin or during archive decompression. This could lead to system compromise or unauthorized actions performed with the privileges of the Vim user.

A fix is available. Users should apply the vendor-provided updates to Vim packages as soon as possible. For Ubuntu, standard system updates will install patched versions starting from 2:9.1.0016-1ubuntu7.15 and later depending on the release. For Red Hat Enterprise Linux 9.4, update to vim-8.2.2637-20.el9_4.3 or later. Ubuntu Pro customers should apply fixes available via Ubuntu Pro or Legacy Support add-ons. No additional mitigation steps are indicated by the vendors.