Threats Tagged 'cve-2026-57456'

Multiple security vulnerabilities have been identified in Vim (Vi IMproved), including several that allow arbitrary code execution via crafted inputs such as directory names, Python omni-completion, PHP files, tags files, vimball files, and insecure shell command handling. Additionally, there are vulnerabilities leading to denial of service via stack out-of-bounds writes and out-of-bounds writes in spell file word counts. These issues affect Red Hat Enterprise Linux 10.0 Extended Update Support and related packages. Red Hat has issued security advisories and updates addressing these vulnerabilities.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421) * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421) * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This security update provides a functional equivalent of RHSA-2026:42828. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:42828.

This update includes the following RPMs: vim: * vim-X11-9.2.780-1.hum1 (aarch64, x86_64) * vim-common-9.2.780-1.hum1 (aarch64, x86_64) * vim-data-9.2.780-1.hum1 (noarch) * vim-default-editor-9.2.780-1.hum1 (noarch) * vim-enhanced-9.2.780-1.hum1 (aarch64, x86_64) * vim-filesystem-9.2.780-1.hum1 (noarch) * vim-minimal-9.2.780-1.hum1 (aarch64, x86_64) * xxd-9.2.780-1.hum1 (aarch64, x86_64) * vim-9.2.780-1.hum1.src (src)

This update includes the following RPMs: vim: * vim-X11-9.2.780-1.hum1 (aarch64, x86_64) * vim-common-9.2.780-1.hum1 (aarch64, x86_64) * vim-data-9.2.780-1.hum1 (noarch) * vim-default-editor-9.2.780-1.hum1 (noarch) * vim-enhanced-9.2.780-1.hum1 (aarch64, x86_64) * vim-filesystem-9.2.780-1.hum1 (noarch) * vim-minimal-9.2.780-1.hum1 (aarch64, x86_64) * xxd-9.2.780-1.hum1 (aarch64, x86_64) * vim-9.2.780-1.hum1.src (src)