vim: command injection when decompressing .tgz archives

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape without the special flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current...

CVE-2026-57455

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service DoS. When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spellsoundfoldsofo function, causing the editor to crash. Mitigation...

CVE-2026-57452

A flaw was found in Vim, an open source command-line text editor. When opening a specially crafted encrypted file using the VimCrypt04! or VimCrypt05! methods, an attacker could trigger an unsigned length calculation error. This issue leads to an out-of-bounds read, causing Vim to crash and...

RHSA-2026:33453 Red Hat Security Advisory: vim security update

Bulletin has no description...

CVE-2026-57451

A flaw in Vim allows an attacker to cause a Denial of Service DoS via an application crash. If a user opens a maliciously crafted undo file, an out-of-bounds read is triggered in the gettextprops function due to missing length validation on property counts. Mitigation Users are advised to avoid...

CVE-2026-55895

A flaw was found in Vim, specifically within the netrw plugin. A local user could exploit a Vimscript code injection vulnerability by attempting to delete a specially crafted local file from the browser. This crafted filename, containing a bar character, could be interpolated into an Ex command,...

CVE-2026-57454 affecting package vim for versions less than 9.2.0735-1

CVE-2026-57454 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-57456 affecting package vim for versions less than 9.2.0735-1

CVE-2026-57456 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-57455 affecting package vim for versions less than 9.2.0735-1

CVE-2026-57455 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55693 affecting package vim for versions less than 9.2.0735-1

CVE-2026-55693 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-57452 affecting package vim for versions less than 9.2.0735-1

CVE-2026-57452 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-57453 affecting package vim for versions less than 9.2.0735-1

CVE-2026-57453 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55892 affecting package vim for versions less than 9.2.0735-1

CVE-2026-55892 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55895 affecting package vim for versions less than 9.2.0735-1

CVE-2026-55895 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-57451 affecting package vim for versions less than 9.2.0735-1

CVE-2026-57451 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

RHEL 8 : vim (RHSA-2026:34476)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34476 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: arbitrary command execution via modeline sandbox...

RHEL 8 : vim (RHSA-2026:34477)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34477 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: arbitrary command execution via modeline sandbox...

Alibaba Cloud Linux 3 : 0176: vim (ALINUX3-SA-2026:0176)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0176 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-41411: Vim is an open source, command line...

RHSA-2026:30900 Red Hat Security Advisory: vim security update

Bulletin has no description...

vim: command injection when decompressing .tgz archives

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape without the special flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current...