Issued at: 2026-09-11
Updated at: 2026-09-12
Advisory content derived from Red Hat RHSA-2026:66336, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: vim security update
Description
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)
* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)
* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)
* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)
* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)
* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.