Vulnerability-Lookup

RHSA-2026:66336

Vulnerability from csaf_opensuse - Published: 2026-09-10 07:38 - Updated: 2026-09-10 17:22

Summary

Red Hat Security Advisory: vim security update

Severity

Important

Notes

Topic: An update for vim is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-28420

A flaw was found in Vim. A remote attacker could exploit a heap-based buffer overflow and an out-of-bounds read vulnerability in Vim's terminal emulator. This occurs when processing specially crafted Unicode supplementary plane characters, potentially leading to information disclosure and denial of service.

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 62 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-52859

A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service (DoS) for the user.

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 62 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-55892

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted spell file. This malicious file can trigger a stack out-of-bounds write, which corrupts the editor's memory and causes it to crash. This leads to a Denial of Service (DoS), making the editor unavailable to the user.

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 62 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-59857

An out-of-bounds write vulnerability in Vim's spell_soundfold_sal() function allows an attacker to corrupt memory and crash the editor (Denial of Service) by supplying a specially crafted word during spell sound-folding.

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 62 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2026-73072

A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 62 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-73076

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-73077

A vulnerability in Vim's shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Important

CVE-2026-73078

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src	—	Vendor Fix fix Workaround

Known not affected 66 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x	—	Workaround
Unresolved product id: BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64	—	Workaround

Threats

Impact Important

References

63 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:66336	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2443484	external
https://bugzilla.redhat.com/show_bug.cgi?id=2487989	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492975	external
https://bugzilla.redhat.com/show_bug.cgi?id=2498863	external
https://bugzilla.redhat.com/show_bug.cgi?id=2514034	external
https://bugzilla.redhat.com/show_bug.cgi?id=2514037	external
https://bugzilla.redhat.com/show_bug.cgi?id=2514058	external
https://bugzilla.redhat.com/show_bug.cgi?id=2514065	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-28420	self
https://bugzilla.redhat.com/show_bug.cgi?id=2443484	external
https://www.cve.org/CVERecord?id=CVE-2026-28420	external
https://nvd.nist.gov/vuln/detail/CVE-2026-28420	external
https://github.com/vim/vim/commit/bb6de2105b160e7…	external
https://github.com/vim/vim/releases/tag/v9.2.0076	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-52859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2487989	external
https://www.cve.org/CVERecord?id=CVE-2026-52859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-52859	external
https://github.com/vim/vim/commit/63680c6d3d52477…	external
https://github.com/vim/vim/releases/tag/v9.2.0565	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-55892	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492975	external
https://www.cve.org/CVERecord?id=CVE-2026-55892	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55892	external
https://github.com/vim/vim/commit/8325b193bba5f01…	external
https://github.com/vim/vim/releases/tag/v9.2.0662	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-59857	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498863	external
https://www.cve.org/CVERecord?id=CVE-2026-59857	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59857	external
https://github.com/vim/vim/commit/d22ff1c955ff87e…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-73072	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514037	external
https://www.cve.org/CVERecord?id=CVE-2026-73072	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73072	external
https://github.com/vim/vim/commit/05c41c922309c7a…	external
https://github.com/vim/vim/releases/tag/v9.2.0846	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-73076	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514034	external
https://www.cve.org/CVERecord?id=CVE-2026-73076	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73076	external
https://github.com/vim/vim/commit/581a2f3ac9c6f96…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-73077	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514065	external
https://www.cve.org/CVERecord?id=CVE-2026-73077	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73077	external
https://github.com/vim/vim/commit/c5a82fe013e73c9…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-73078	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514058	external
https://www.cve.org/CVERecord?id=CVE-2026-73078	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73078	external
https://github.com/vim/vim/commit/29c6fd090d45205…	external
https://github.com/vim/vim/security/advisories/GH…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for vim is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n\n* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n\n* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n\n* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n\n* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n\n* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n\n* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n\n* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66336",
        "url": "https://access.redhat.com/errata/RHSA-2026:66336"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2443484",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443484"
      },
      {
        "category": "external",
        "summary": "2487989",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487989"
      },
      {
        "category": "external",
        "summary": "2492975",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492975"
      },
      {
        "category": "external",
        "summary": "2498863",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498863"
      },
      {
        "category": "external",
        "summary": "2514034",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514034"
      },
      {
        "category": "external",
        "summary": "2514037",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514037"
      },
      {
        "category": "external",
        "summary": "2514058",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514058"
      },
      {
        "category": "external",
        "summary": "2514065",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514065"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66336.json"
      }
    ],
    "title": "Red Hat Security Advisory: vim security update",
    "tracking": {
      "current_release_date": "2026-09-10T17:22:21+00:00",
      "generator": {
        "date": "2026-09-10T17:22:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:66336",
      "initial_release_date": "2026-09-10T07:38:59+00:00",
      "revision_history": [
        {
          "date": "2026-09-10T07:38:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-10T07:38:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T17:22:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                  "product_id": "BaseOS-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-X11-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-X11-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-common-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-common-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "xxd-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "xxd-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
                "product": {
                  "name": "vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
                  "product_id": "vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.20?arch=aarch64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-common-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-common-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "xxd-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "xxd-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
                "product": {
                  "name": "vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_id": "vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.20?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-X11-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-X11-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-common-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-common-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "xxd-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "xxd-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-9.el10_2.20.s390x",
                "product": {
                  "name": "vim-minimal-2:9.1.083-9.el10_2.20.s390x",
                  "product_id": "vim-minimal-2:9.1.083-9.el10_2.20.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.20?arch=s390x\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-X11-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-X11-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-common-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-common-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-common@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "xxd-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "xxd-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debugsource@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-X11-debuginfo@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-debuginfo@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xxd-debuginfo@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
                "product": {
                  "name": "vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
                  "product_id": "vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-minimal@9.1.083-9.el10_2.20?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-2:9.1.083-9.el10_2.20.src",
                "product": {
                  "name": "vim-2:9.1.083-9.el10_2.20.src",
                  "product_id": "vim-2:9.1.083-9.el10_2.20.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim@9.1.083-9.el10_2.20?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-data-2:9.1.083-9.el10_2.20.noarch",
                "product": {
                  "name": "vim-data-2:9.1.083-9.el10_2.20.noarch",
                  "product_id": "vim-data-2:9.1.083-9.el10_2.20.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-data@9.1.083-9.el10_2.20?arch=noarch\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
                "product": {
                  "name": "vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
                  "product_id": "vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vim-filesystem@9.1.083-9.el10_2.20?arch=noarch\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-X11-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-X11-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-X11-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-common-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-common-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-common-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-common-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "xxd-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "xxd-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "xxd-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "xxd-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-2:9.1.083-9.el10_2.20.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        },
        "product_reference": "vim-2:9.1.083-9.el10_2.20.src",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-2:9.1.083-9.el10_2.20.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch"
        },
        "product_reference": "vim-data-2:9.1.083-9.el10_2.20.noarch",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-filesystem-2:9.1.083-9.el10_2.20.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch"
        },
        "product_reference": "vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-minimal-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        },
        "product_reference": "xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-28420",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-02-27T23:02:26.039794+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443484"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. A remote attacker could exploit a heap-based buffer overflow and an out-of-bounds read vulnerability in Vim\u0027s terminal emulator. This occurs when processing specially crafted Unicode supplementary plane characters, potentially leading to information disclosure and denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28420"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443484",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443484"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28420",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28420"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28420",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28420"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063",
          "url": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0076",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0076"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg"
        }
      ],
      "release_date": "2026-02-27T22:04:36.189000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator"
    },
    {
      "cve": "CVE-2026-52859",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-11T19:02:24.309768+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service (DoS) for the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via out-of-bounds write in terminal handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Vim allows a local attacker to cause a denial of service. By displaying specially crafted output within a Vim `:terminal` window, an attacker can trigger an out-of-bounds write, leading to the application crashing. This primarily impacts users who interact with untrusted content or execute untrusted programs within Vim\u0027s terminal emulator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-52859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-52859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52859"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19",
          "url": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0565",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0565"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm"
        }
      ],
      "release_date": "2026-06-11T18:33:09.886000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "Users should exercise caution when opening untrusted files or executing untrusted programs within vim\u0027s `:terminal` window. Avoiding interaction with untrusted content in this context can prevent the exploitation of this vulnerability, which leads to a denial of service.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via out-of-bounds write in terminal handling"
    },
    {
      "cve": "CVE-2026-55892",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-25T16:01:52.997166+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492975"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted spell file. This malicious file can trigger a stack out-of-bounds write, which corrupts the editor\u0027s memory and causes it to crash. This leads to a Denial of Service (DoS), making the editor unavailable to the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via crafted spell file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Vim\u0027s spell file handling. The dump_prefixes() function in src/spell.c does not validate the depth of the prefix trie against the size of fixed-size stack arrays, allowing a crafted .spl file to cause a stack out-of-bounds write and crash. Red Hat ships Vim in all RHEL versions and OpenShift CoreOS. Exploitation requires a user to load a malicious spell file and run :spelldump or spelling completion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55892"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492975",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492975"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55892",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55892"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55892",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55892"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241f",
          "url": "https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241f"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0662",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0662"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h"
        }
      ],
      "release_date": "2026-06-25T15:32:41.238000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "Do not load untrusted spell files (.spl) from unknown sources. Avoid using :spelldump with spell files of unknown provenance.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via crafted spell file"
    },
    {
      "cve": "CVE-2026-59857",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-09T23:01:27.257331+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498863"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds write vulnerability in Vim\u0027s spell_soundfold_sal() function allows an attacker to corrupt memory and crash the editor (Denial of Service) by supplying a specially crafted word during spell sound-folding.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Vim\u0027s spell sound-folding feature can lead to a denial of service. A local attacker could provide a specially crafted word, causing an out-of-bounds write and crashing the editor. This vulnerability primarily affects interactive users of the Vim text editor.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498863",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498863"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59857"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30",
          "url": "https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2"
        }
      ],
      "release_date": "2026-07-09T22:34:54.698000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "This vulnerability can be mitigated by preventing Vim from automatically applying editor configurations embedded in files.\nAdd the following line to the global /etc/vimrc or local ~/.vimrc configuration file:\nset nomodeline",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding"
    },
    {
      "cve": "CVE-2026-73072",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-11T15:41:15.596551+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Heap buffer overflow allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A local attacker can exploit an Important heap buffer overflow in Vim to execute arbitrary code by tricking a user into loading a malicious spell file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73072",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
          "url": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0846",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0846"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
        }
      ],
      "release_date": "2026-08-11T15:31:35.331000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim\u2019s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Heap buffer overflow allows arbitrary code execution"
    },
    {
      "cve": "CVE-2026-73076",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T15:41:02.894650+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514034"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted vimball",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim where a crafted vimball can lead to arbitrary command execution. The flaw allows an attacker to embed malicious commands within a `.VimballRecord` file, which are then executed with user privileges during a later, unrelated vimball installation or removal. This extends the impact of processing untrusted vimball files beyond the initial installation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514034",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514034"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452",
          "url": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
        }
      ],
      "release_date": "2026-08-11T15:37:59.894000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted vimball"
    },
    {
      "cve": "CVE-2026-73077",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T16:11:25.535913+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514065"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Vim\u0027s shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s shell plugins allows full system compromise in Red Hat environments if a user selects crafted text in Visual mode and triggers a keyword lookup. This does not affect RHEL 8 and older versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514065",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514065"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73077",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
          "url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
        }
      ],
      "release_date": "2026-08-11T15:39:24.579000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory:\n\n- `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=`\n\nThis change takes effect the next time a shell script is opened in Vim.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling"
    },
    {
      "cve": "CVE-2026-73078",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T16:10:59.827742+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514058"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Vim\u0027s netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s `netrw` plugin allows for arbitrary command execution in GUI Vim. By crafting a malicious directory path, an attacker could exploit improper neutralization of special characters when the path is browsed or bookmarked, leading to command injection. This issue specifically impacts GUI installations and requires user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
        ],
        "known_not_affected": [
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
          "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514058",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514058"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73078",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
          "url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
        }
      ],
      "release_date": "2026-08-11T15:41:08.048000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T07:38:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66336"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.",
          "product_ids": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-common-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-2:9.1.083-9.el10_2.20.x86_64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "AppStream-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-2:9.1.083-9.el10_2.20.src",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-X11-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-data-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-debugsource-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-enhanced-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-filesystem-2:9.1.083-9.el10_2.20.noarch",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:vim-minimal-debuginfo-2:9.1.083-9.el10_2.20.x86_64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.aarch64",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.ppc64le",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.s390x",
            "BaseOS-10.2.Z:xxd-debuginfo-2:9.1.083-9.el10_2.20.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries"
    }
  ]
}

CVE-2026-28420 (GCVE-0-2026-28420)

Vulnerability from cvelistv5 – Published: 2026-02-27 22:04 – Updated: 2026-03-02 21:55

Title

Vim has Heap-based Buffer Overflow and OOB Read in :terminal

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-02 21:54 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/bb6de2105b160e7…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0076	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/02/27/9

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0076

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-28T00:15:35.201Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/02/27/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-02T21:54:55.613292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-02T21:55:05.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0076"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim\u0027s terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-27T22:04:36.189Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg"
        },
        {
          "name": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0076",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0076"
        }
      ],
      "source": {
        "advisory": "GHSA-rvj2-jrf9-2phg",
        "discovery": "UNKNOWN"
      },
      "title": "Vim has Heap-based Buffer Overflow and OOB Read in :terminal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28420",
    "datePublished": "2026-02-27T22:04:36.189Z",
    "dateReserved": "2026-02-27T15:33:57.290Z",
    "dateUpdated": "2026-03-02T21:55:05.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52859 (GCVE-0-2026-52859)

Vulnerability from cvelistv5 – Published: 2026-06-11 18:33 – Updated: 2026-06-11 19:38

Title

Vim: Out-of-bounds Read in Terminal Screen Snapshot

Summary

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 19:35 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/63680c6d3d52477…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0565	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0565

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T19:35:19.075882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T19:38:46.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0565"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell\u0027s chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots \u2014 a base character plus five combining marks \u2014 the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T18:33:09.886Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm"
        },
        {
          "name": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0565",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0565"
        }
      ],
      "source": {
        "advisory": "GHSA-47gw-8gc3-mgcm",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Read in Terminal Screen Snapshot"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52859",
    "datePublished": "2026-06-11T18:33:09.886Z",
    "dateReserved": "2026-06-08T18:41:27.725Z",
    "dateUpdated": "2026-06-11T19:38:46.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55892 (GCVE-0-2026-55892)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:32 – Updated: 2026-06-26 18:43

Title

Vim: Out-of-bounds Write in Spell File Prefix Dump

Summary

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 17:50 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/8325b193bba5f01…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0662	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0662

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55892",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T17:50:52.811086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T18:43:09.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0662"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:32:41.238Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h"
        },
        {
          "name": "https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241f"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0662",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0662"
        }
      ],
      "source": {
        "advisory": "GHSA-qm9w-fmpj-879h",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Write in Spell File Prefix Dump"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55892",
    "datePublished": "2026-06-25T15:32:41.238Z",
    "dateReserved": "2026-06-17T16:59:42.760Z",
    "dateUpdated": "2026-06-26T18:43:09.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59857 (GCVE-0-2026-59857)

Vulnerability from cvelistv5 – Published: 2026-07-09 22:34 – Updated: 2026-07-10 14:14

Title

Vim: Out-of-bounds Write in SAL Soundfolding

Summary

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.

Severity

5.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 14:14 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/d22ff1c955ff87e…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0725

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T14:14:30.879772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T14:14:40.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0725"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file\u0027s SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen \u003c MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T22:34:54.698Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2"
        },
        {
          "name": "https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30"
        }
      ],
      "source": {
        "advisory": "GHSA-m3hf-xcm3-xhm2",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Write in SAL Soundfolding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59857",
    "datePublished": "2026-07-09T22:34:54.698Z",
    "dateReserved": "2026-07-07T15:41:53.606Z",
    "dateUpdated": "2026-07-10T14:14:40.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73072 (GCVE-0-2026-73072)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:31 – Updated: 2026-08-13 15:17

Title

Vim: Heap Buffer Overflow when Loading a Spell File

Summary

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:17 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/05c41c922309c7a…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0846	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0846

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:17:40.993543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:17:50.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0846"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:31:35.331Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
        },
        {
          "name": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0846",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0846"
        }
      ],
      "source": {
        "advisory": "GHSA-9jqx-hgpr-6v64",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Heap Buffer Overflow when Loading a Spell File"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73072",
    "datePublished": "2026-08-11T15:31:35.331Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-13T15:17:50.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73076 (GCVE-0-2026-73076)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:37 – Updated: 2026-08-11 15:54

Title

Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

Summary

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 15:53 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/581a2f3ac9c6f96…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0847

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T15:53:49.920723Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T15:54:03.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0847"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:37:59.894Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
        },
        {
          "name": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452"
        }
      ],
      "source": {
        "advisory": "GHSA-r22p-fhw4-84p2",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73076",
    "datePublished": "2026-08-11T15:37:59.894Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T15:54:03.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73077 (GCVE-0-2026-73077)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:39 – Updated: 2026-08-11 18:33

Title

Vim: Arbitrary Code Execution via Shell Keyword Lookup

Summary

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 18:33 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/c5a82fe013e73c9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0839

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T18:33:20.954919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T18:33:31.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0839"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:39:24.579Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
        },
        {
          "name": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
        }
      ],
      "source": {
        "advisory": "GHSA-r5v6-q6j8-8qw2",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Shell Keyword Lookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73077",
    "datePublished": "2026-08-11T15:39:24.579Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T18:33:31.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73078 (GCVE-0-2026-73078)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:41 – Updated: 2026-08-11 16:57

Title

Vim: Arbitrary Code Execution via Netrw Menu Construction

Summary

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 16:56 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/29c6fd090d45205…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0840

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T16:56:42.968042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T16:57:05.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0840"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:41:08.048Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
        },
        {
          "name": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
        }
      ],
      "source": {
        "advisory": "GHSA-rcr7-f3wr-22r2",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Netrw Menu Construction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73078",
    "datePublished": "2026-08-11T15:41:08.048Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T16:57:05.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:66336

CVE-2026-28420 (GCVE-0-2026-28420)

CVE-2026-52859 (GCVE-0-2026-52859)

CVE-2026-55892 (GCVE-0-2026-55892)

CVE-2026-59857 (GCVE-0-2026-59857)

CVE-2026-73072 (GCVE-0-2026-73072)

CVE-2026-73076 (GCVE-0-2026-73076)

CVE-2026-73077 (GCVE-0-2026-73077)

CVE-2026-73078 (GCVE-0-2026-73078)

Tags

Sightings

Nomenclature