Threats Tagged 'cve-2026-59856'

Multiple security vulnerabilities have been identified in Vim (Vi IMproved), including several that allow arbitrary code execution via crafted inputs such as directory names, Python omni-completion, PHP files, tags files, vimball files, and insecure shell command handling. Additionally, there are vulnerabilities leading to denial of service via stack out-of-bounds writes and out-of-bounds writes in spell file word counts. These issues affect Red Hat Enterprise Linux 10.0 Extended Update Support and related packages. Red Hat has issued security advisories and updates addressing these vulnerabilities.

Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

This security update provides a functional equivalent of RHSA-2026:42828. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:42828.

This security update for vim addresses multiple vulnerabilities fixed in version 9.2.0780. The key security issues include arbitrary code execution vulnerabilities via PHP and C omni-completion due to improper escaping, and an out-of-bounds write in SAL soundfolding caused by improper bounds checking. The update also includes numerous other bug fixes and improvements unrelated to security.

This update includes the following RPMs: vim: * vim-X11-9.2.780-1.hum1 (aarch64, x86_64) * vim-common-9.2.780-1.hum1 (aarch64, x86_64) * vim-data-9.2.780-1.hum1 (noarch) * vim-default-editor-9.2.780-1.hum1 (noarch) * vim-enhanced-9.2.780-1.hum1 (aarch64, x86_64) * vim-filesystem-9.2.780-1.hum1 (noarch) * vim-minimal-9.2.780-1.hum1 (aarch64, x86_64) * xxd-9.2.780-1.hum1 (aarch64, x86_64) * vim-9.2.780-1.hum1.src (src)

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.