RHSA-2026:99165: Important: vim security, bug fix, and enhancement update
Vim (Vi IMproved) is an updated and improved version of the vi editor.Security Fix(es): vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code execution (CVE-2026-43961) Bug Fix(es) and Enhancement(s): vim writes file in place even though creating a backup is possible [rhel-10.2.z] (JIRA:RHEL-282869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/vimto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-commonto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-datato a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-debugsourceto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-enhancedto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-enhanced-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-filesystemto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-minimalto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/xxdto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/xxd-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2 - Upgrade
Upgrade
redhat/vim-commonto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/vim-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/vim-debugsourceto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/vim-enhancedto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/vim-enhanced-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/vim-minimalto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/vim-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/xxdto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa - Upgrade
Upgrade
redhat/xxd-debuginfoto a version that resolves this vulnerability.Fixed in 9.1.083-26.el10_2.aa
Event History
Frequently Asked Questions
Which Vim packages are included in this update?
The update covers vim-common, vim-enhanced, vim-minimal, xxd, and their listed debuginfo and debugsource packages.
Does this update include changes beyond the security fix?
Yes. It also addresses an issue in the RHEL 10.2.z stream where Vim writes a file in place even when creating a backup is possible.