REDHAT-BUG-2455400: High severity vim Vim vulnerability

Published Apr 6, 2026
·
Updated

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the PMLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a checksecure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Affected Software

1 affected component
vim Vim<9.2.0276

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Vim to a version that resolves this vulnerability.

    Fixed in 9.2.0276Patch 9.2.0276
  2. Compensating control

    For Vim, ensure the modeline sandbox restrictions are enforced by using settings that include the P_MLE flag for the `complete`, `guitabtooltip`, and `printheader` options, since missing the `P_MLE` flag allows a modeline to be executed.

Event History

Apr 6, 2026
Data Sourced
via Red Hat·04:02 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2455400?

The severity of REDHAT-BUG-2455400 is critical due to the risk of arbitrary OS command execution.

2

How do I fix REDHAT-BUG-2455400?

To fix REDHAT-BUG-2455400, upgrade Vim to version 9.2.0276 or later.

3

What versions of Vim are affected by REDHAT-BUG-2455400?

Vim versions prior to 9.2.0276 are affected by REDHAT-BUG-2455400.

4

What is a modeline sandbox bypass in REDHAT-BUG-2455400?

A modeline sandbox bypass in REDHAT-BUG-2455400 allows crafted files to execute arbitrary OS commands when opened in Vim.

5

Who is responsible for the vulnerability REDHAT-BUG-2455400?

The vulnerability REDHAT-BUG-2455400 is a result of improper option handling in Vim.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203