RLSA-2026:66366

vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)
vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)
vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)
vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)
vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)
vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific

{
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:66366"
}

References

Credits

- Rocky Enterprise Software Foundation
- Red Hat

Affected packages

Rocky Linux:9 / vim

Package

Name: vim
Purl: pkg:rpm/rocky-linux/vim?distro=rocky-linux-9&epoch=2

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2:8.2.2637-26.el9_8.21

Database specific

Show details

{
    "yum_repository": "BaseOS"
}

Database specific

source

"https://storage.googleapis.com/resf-osv-data/RLSA-2026:66366.json"