Vulnerability-Lookup

RHSA-2026:55431

Vulnerability from csaf_redhat - Published: 2026-08-17 02:46 - Updated: 2026-08-17 10:09

Summary

Red Hat Security Advisory: vim security update

Severity

Important

Notes

Topic: An update for vim is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-47162

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-140 - Improper Neutralization of Delimiters

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix

Known not affected 66 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—

Threats

Impact Important

CVE-2026-47167

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user's system.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-52858

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-55693

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix

Known not affected 62 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x		—
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64		—

Threats

Impact Moderate

CVE-2026-57455

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix Workaround

Known not affected 62 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-57456

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-59856

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-59858

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x	—	Workaround
Unresolved product id: BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64	—	Workaround

Threats

Impact Moderate

References

63 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:55431	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2487964	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492968	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492972	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492980	external
https://bugzilla.redhat.com/show_bug.cgi?id=2498867	external
https://bugzilla.redhat.com/show_bug.cgi?id=2498868	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-47162	self
https://bugzilla.redhat.com/show_bug.cgi?id=2487964	external
https://www.cve.org/CVERecord?id=CVE-2026-47162	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47162	external
https://github.com/vim/vim/commit/f08ab2f4d7d2947…	external
https://github.com/vim/vim/releases/tag/v9.2.0495	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-47167	self
https://bugzilla.redhat.com/show_bug.cgi?id=2487996	external
https://www.cve.org/CVERecord?id=CVE-2026-47167	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47167	external
https://github.com/vim/vim/commit/a65a52d684bc585…	external
https://github.com/vim/vim/releases/tag/v9.2.0496	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-52858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2487981	external
https://www.cve.org/CVERecord?id=CVE-2026-52858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-52858	external
https://github.com/vim/vim/commit/4b850457e12e1a6…	external
https://github.com/vim/vim/releases/tag/v9.2.0561	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-55693	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492980	external
https://www.cve.org/CVERecord?id=CVE-2026-55693	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55693	external
https://github.com/vim/vim/commit/a80874d9b84a010…	external
https://github.com/vim/vim/releases/tag/v9.2.0653	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-57455	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492968	external
https://www.cve.org/CVERecord?id=CVE-2026-57455	external
https://nvd.nist.gov/vuln/detail/CVE-2026-57455	external
https://github.com/vim/vim/commit/497f931f85339d1…	external
https://github.com/vim/vim/releases/tag/v9.2.0698	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-57456	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492972	external
https://www.cve.org/CVERecord?id=CVE-2026-57456	external
https://nvd.nist.gov/vuln/detail/CVE-2026-57456	external
https://github.com/vim/vim/commit/cce141c42740f12…	external
https://github.com/vim/vim/releases/tag/v9.2.0699	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-59856	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498867	external
https://www.cve.org/CVERecord?id=CVE-2026-59856	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59856	external
https://github.com/vim/vim/commit/43afc581a37a357…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-59858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498868	external
https://www.cve.org/CVERecord?id=CVE-2026-59858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59858	external
https://github.com/vim/vim/commit/6b611b0d15603c5…	external
https://github.com/vim/vim/security/advisories/GH…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for vim is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)\n\n* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)\n\n* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)\n\n* vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)\n\n* vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)\n\n* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)\n\n* vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)\n\n* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:55431",
        "url": "https://access.redhat.com/errata/RHSA-2026:55431"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2487964",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
      },
      {
        "category": "external",
        "summary": "2492968",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
      },
      {
        "category": "external",
        "summary": "2492972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
      },
      {
        "category": "external",
        "summary": "2492980",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
      },
      {
        "category": "external",
        "summary": "2498867",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
      },
      {
        "category": "external",
        "summary": "2498868",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55431.json"
      }
    ],
    "title": "Red Hat Security Advisory: vim security update",
    "tracking": {
      "current_release_date": "2026-08-17T10:09:04+00:00",
      "generator": {
        "date": "2026-08-17T10:09:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:55431",
      "initial_release_date": "2026-08-17T02:46:59+00:00",
      "revision_history": [
        {
          "date": "2026-08-17T02:46:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-17T02:46:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-17T10:09:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
                  "product_id": "BaseOS-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-X11-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-X11-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-common-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-common-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "xxd-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "xxd-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
                "product": {
                  "name": "vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
                  "product_id": "vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-5.el10_0.4?arch=aarch64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-common-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-common-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "xxd-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "xxd-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
                "product": {
                  "name": "vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_id": "vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-5.el10_0.4?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-X11-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-X11-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-common-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-common-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "xxd-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "xxd-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-5.el10_0.4.s390x",
                "product": {
                  "name": "vim-minimal-2:9.1.083-5.el10_0.4.s390x",
                  "product_id": "vim-minimal-2:9.1.083-5.el10_0.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-5.el10_0.4?arch=s390x\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-X11-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-X11-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-common-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-common-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "xxd-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "xxd-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
                "product": {
                  "name": "vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
                  "product_id": "vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-5.el10_0.4?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-2:9.1.083-5.el10_0.4.src",
                "product": {
                  "name": "vim-2:9.1.083-5.el10_0.4.src",
                  "product_id": "vim-2:9.1.083-5.el10_0.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim@9.1.083-5.el10_0.4?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-data-2:9.1.083-5.el10_0.4.noarch",
                "product": {
                  "name": "vim-data-2:9.1.083-5.el10_0.4.noarch",
                  "product_id": "vim-data-2:9.1.083-5.el10_0.4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-data@9.1.083-5.el10_0.4?arch=noarch\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
                "product": {
                  "name": "vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
                  "product_id": "vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-filesystem@9.1.083-5.el10_0.4?arch=noarch\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-X11-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-X11-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-X11-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-common-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-common-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-common-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-common-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "xxd-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "xxd-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "xxd-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "xxd-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-2:9.1.083-5.el10_0.4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        },
        "product_reference": "vim-2:9.1.083-5.el10_0.4.src",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-2:9.1.083-5.el10_0.4.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch"
        },
        "product_reference": "vim-data-2:9.1.083-5.el10_0.4.noarch",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-filesystem-2:9.1.083-5.el10_0.4.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch"
        },
        "product_reference": "vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-minimal-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)",
          "product_id": "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
        "relates_to_product_reference": "BaseOS-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-47162",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-06-11T19:00:56.050612+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via crafted directory names",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47162",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
          "url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0495",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
        }
      ],
      "release_date": "2026-06-11T18:32:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via crafted directory names"
    },
    {
      "cve": "CVE-2026-47167",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:02:45.999423+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487996"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted step-definition patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487996",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487996"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47167",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
          "url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0496",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
        }
      ],
      "release_date": "2026-06-11T18:31:44.286000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted step-definition patterns"
    },
    {
      "cve": "CVE-2026-52858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:01:57.042099+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487981"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user\u0027s system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487981",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487981"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-52858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
          "url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0561",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
        }
      ],
      "release_date": "2026-06-11T18:32:32.722000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        },
        {
          "category": "workaround",
          "details": "Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via Python omni-completion"
    },
    {
      "cve": "CVE-2026-55693",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-25T16:02:21.870241+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        }
      ],
      "release_date": "2026-06-25T15:34:33.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
    },
    {
      "cve": "CVE-2026-57455",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-25T16:01:18.343208+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492968"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492968",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        }
      ],
      "release_date": "2026-06-25T15:22:37.949000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
    },
    {
      "cve": "CVE-2026-57456",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-25T16:01:37.648886+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        }
      ],
      "release_date": "2026-06-25T15:16:16.015000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
    },
    {
      "cve": "CVE-2026-59856",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:40.406872+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        }
      ],
      "release_date": "2026-07-09T22:39:01.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        },
        {
          "category": "workaround",
          "details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
    },
    {
      "cve": "CVE-2026-59858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:43.278752+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
        ],
        "known_not_affected": [
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
          "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        }
      ],
      "release_date": "2026-07-09T22:37:52.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T02:46:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55431"
        },
        {
          "category": "workaround",
          "details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-common-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-2:9.1.083-5.el10_0.4.x86_64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "AppStream-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-2:9.1.083-5.el10_0.4.src",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-X11-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-data-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-debugsource-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-enhanced-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-filesystem-2:9.1.083-5.el10_0.4.noarch",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:vim-minimal-debuginfo-2:9.1.083-5.el10_0.4.x86_64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.aarch64",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.ppc64le",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.s390x",
            "BaseOS-10.0.Z.E2S:xxd-debuginfo-2:9.1.083-5.el10_0.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
    }
  ]
}

CVE-2026-47162 (GCVE-0-2026-47162)

Vulnerability from cvelistv5 – Published: 2026-06-11 18:32 – Updated: 2026-08-17 12:05

Title

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-12 03:55 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-140 - Improper Neutralization of Delimiters

Assigner

GitHub_M

References

11 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/f08ab2f4d7d2947…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0495	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-47162	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2487964	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:55431	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38509	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38510	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38511	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371	vendor-advisoryx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
vim	vim	Affected: < 9.2.0495
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:9.1.083-9.el10_2.7 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 2:8.0.1763-27.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:8.2.2637-26.el9_8.10 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1786433656 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T03:55:42.649076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T12:47:52.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "vim",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:9.1.083-9.el10_2.7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8",
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "vim",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:8.0.1763-27.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "vim",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:8.2.2637-26.el9_8.10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "insights-proxy/insights-proxy-container-rhel9",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786433656",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "packageName": "vim",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "vim",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-11T18:32:14.471Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-140",
                "description": "Improper Neutralization of Delimiters",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T12:05:13.187Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
          },
          {
            "name": "RHBZ#2487964",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55431"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38509"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38510"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38511"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53371"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:55431: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38509: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38510: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38511: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53371: Red Hat Insights proxy 1.5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-11T19:00:56.050Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-11T18:32:14.471Z",
            "value": "Made public."
          }
        ],
        "title": "vim: Vim: Arbitrary Code Execution via crafted directory names",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0495"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T18:32:14.471Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
        },
        {
          "name": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0495",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
        }
      ],
      "source": {
        "advisory": "GHSA-crm5-rh6j-2c7c",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47162",
    "datePublished": "2026-06-11T18:32:14.471Z",
    "dateReserved": "2026-05-18T21:25:34.496Z",
    "dateUpdated": "2026-08-17T12:05:13.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47167 (GCVE-0-2026-47167)

Vulnerability from cvelistv5 – Published: 2026-06-11 18:31 – Updated: 2026-06-12 12:47

Title

Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-12 03:55 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/a65a52d684bc585…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0496	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0496

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T03:55:41.579381Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T12:47:36.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0496"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository\u0027s features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T18:31:44.286Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
        },
        {
          "name": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0496",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
        }
      ],
      "source": {
        "advisory": "GHSA-4473-94jm-w5x9",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47167",
    "datePublished": "2026-06-11T18:31:44.286Z",
    "dateReserved": "2026-05-18T21:25:34.497Z",
    "dateUpdated": "2026-06-12T12:47:36.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52858 (GCVE-0-2026-52858)

Vulnerability from cvelistv5 – Published: 2026-06-11 18:32 – Updated: 2026-06-12 12:48

Title

Vim: Arbitrary Code Execution via Python Omni-Completion

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-12 03:55 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/4b850457e12e1a6…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0561	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0561

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T03:55:43.719621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T12:48:03.075Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0561"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python\u0027s import machinery. Because the buffer\u0027s working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package\u0027s top-level code as the editing user. This issue has been patched in version 9.2.0561."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T18:32:32.722Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
        },
        {
          "name": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0561",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
        }
      ],
      "source": {
        "advisory": "GHSA-52mc-rq6p-rc7c",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Python Omni-Completion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52858",
    "datePublished": "2026-06-11T18:32:32.722Z",
    "dateReserved": "2026-06-08T18:41:27.724Z",
    "dateUpdated": "2026-06-12T12:48:03.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55693 (GCVE-0-2026-55693)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:34 – Updated: 2026-06-26 14:03

Title

Vim: Out-of-bounds Write in Spell File Word Count

Summary

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 14:02 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/a80874d9b84a010…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0653	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0653

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T14:02:19.096753Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T14:03:18.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0653"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:34:33.424Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        },
        {
          "name": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        }
      ],
      "source": {
        "advisory": "GHSA-wgh4-64f7-q3jq",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Write in Spell File Word Count"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55693",
    "datePublished": "2026-06-25T15:34:33.424Z",
    "dateReserved": "2026-06-17T00:13:10.650Z",
    "dateUpdated": "2026-06-26T14:03:18.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57455 (GCVE-0-2026-57455)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:22 – Updated: 2026-06-25 23:30

Title

Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

Summary

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.

Severity

4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 23:29 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/497f931f85339d1…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0698	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0698

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T23:29:19.453165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T23:30:00.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0698"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file\u0027s SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:22:37.949Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        },
        {
          "name": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        }
      ],
      "source": {
        "advisory": "GHSA-q8mh-6qm3-25g4",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57455",
    "datePublished": "2026-06-25T15:22:37.949Z",
    "dateReserved": "2026-06-24T13:21:20.730Z",
    "dateUpdated": "2026-06-25T23:30:00.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57456 (GCVE-0-2026-57456)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:16 – Updated: 2026-06-26 03:55

Title

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

Summary

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/cce141c42740f12…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0699	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0699

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57456",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:53.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0699"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0699, Vim\u0027s Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope\u0027s docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:16:16.015Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        },
        {
          "name": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        }
      ],
      "source": {
        "advisory": "GHSA-ppj8-wqjf-6fp3",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57456",
    "datePublished": "2026-06-25T15:16:16.015Z",
    "dateReserved": "2026-06-24T13:21:20.731Z",
    "dateUpdated": "2026-06-26T03:55:53.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59856 (GCVE-0-2026-59856)

Vulnerability from cvelistv5 – Published: 2026-07-09 22:39 – Updated: 2026-07-14 03:55

Title

Vim: Arbitrary Code Execution via PHP Omni-Completion

Summary

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/43afc581a37a357…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0736

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T03:55:39.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0736"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T22:39:01.803Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        },
        {
          "name": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        }
      ],
      "source": {
        "advisory": "GHSA-fh26-8f79-wj97",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via PHP Omni-Completion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59856",
    "datePublished": "2026-07-09T22:39:01.803Z",
    "dateReserved": "2026-07-07T15:41:53.606Z",
    "dateUpdated": "2026-07-14T03:55:39.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59858 (GCVE-0-2026-59858)

Vulnerability from cvelistv5 – Published: 2026-07-09 22:37 – Updated: 2026-07-14 03:55

Title

Vim: Arbitrary Code Execution via C Omni-Completion

Summary

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/6b611b0d15603c5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0735

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T03:55:38.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0735"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T22:37:52.789Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        },
        {
          "name": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        }
      ],
      "source": {
        "advisory": "GHSA-mf92-v4xw-j45x",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via C Omni-Completion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59858",
    "datePublished": "2026-07-09T22:37:52.789Z",
    "dateReserved": "2026-07-07T15:41:53.606Z",
    "dateUpdated": "2026-07-14T03:55:38.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:55431

CVE-2026-47162 (GCVE-0-2026-47162)

CVE-2026-47167 (GCVE-0-2026-47167)

CVE-2026-52858 (GCVE-0-2026-52858)

CVE-2026-55693 (GCVE-0-2026-55693)

CVE-2026-57455 (GCVE-0-2026-57455)

CVE-2026-57456 (GCVE-0-2026-57456)

CVE-2026-59856 (GCVE-0-2026-59856)

CVE-2026-59858 (GCVE-0-2026-59858)

Tags

Sightings

Nomenclature