Loading story…
Red Hat released Vim security updates across RHEL 7 ELS, RHEL 8 and 9 lifecycle channels, and RHEL 10 to remediate command-injection and crafted-file vulnerabilities. CVE-2026-33412 allows arbitrary shell-command execution when an attacker can supply a glob pattern containing a newline on Unix-like systems, subject to Vim's configured shell; upstream fixed it in Vim 9.2.0202. The updates also address CVE-2026-28417, an OS-command-injection issue in the netrw plugin, and CVE-2026-28421, under which a crafted swap file can cause denial of service and disclose information. Several supported channels additionally received fixes for a helpfile-processing arbitrary-code-execution flaw.
Affected organizations should apply the vendor-provided Vim packages through normal Red Hat update procedures. Notable fixed builds include 7.4.629-8.el7_9.1 for RHEL 7 ELS, 8.0.1763-22.el8_10.1 for standard RHEL 8 and 8.10 ELC, 8.2.2637-23.el9_7.2 for RHEL 9, and 9.1.083-6.el10_1.3 for RHEL 10; Red Hat also issued channel-specific updates for older RHEL 8 and RHEL 9 support streams. OpenShift Container Platform 4.13.65 includes updated packages and container images covering Vim and other bundled components, and OCP 4.13 users should upgrade through the applicable release channel.
See real exploitation activity before you spend the cycle.
15 events from the most recent confirmed update back to the earliest known activity.
RHSA-2026:8259 supplied Vim 8.2.2637-23.el9_7.2 for supported RHEL 9 variants and architectures. It fixes the Vim netrw command-injection, crafted-swap-file, and glob() command-injection vulnerabilities.
Red Hat issued RHSA-2026:7711 for supported RHEL 10 deployments, supplying Vim 9.1.083-6.el10_1.3. The update fixes CVE-2026-28417, CVE-2026-28421, and CVE-2026-33412.
RHSA-2026:6915 provided Vim 8.0.1763-22.el8_10.1 for standard RHEL 8 and RHEL 8.10 Extended Life Cycle deployments. It remediates netrw command injection, the crafted-swap-file issue, and CVE-2026-33412 glob() command injection.
Red Hat released RHSA-2026:6736 for RHEL 8.8 Extended Life Cycle Long Life, Telecommunications Update Service, and SAP update offerings. Fixed Vim build 8.0.1763-20.el8_8.1 addresses CVE-2026-33412 and three other Vim flaws.
RHSA-2026:6731 provided Vim 8.0.1763-19.el8_6.5 for supported RHEL 8.6 extended-support repositories. It addressed four Vim vulnerabilities involving helpfile processing, netrw, crafted swap files, and glob().
Red Hat issued RHSA-2026:6729 for RHEL 8.4 AUS and Extended Life Cycle Long Life deployments, supplying Vim 8.0.1763-15.el8_4.1. The advisory remediates four Vim issues including CVE-2026-33412.
RHSA-2026:6730 delivered Vim 8.0.1763-13.el8_2.1 for RHEL Server Advanced Update Support 8.2 on x86_64. It fixed four vulnerabilities, including arbitrary code execution through glob() command injection.
Red Hat released RHSA-2026:6620 for RHEL 9.2 Update Services for SAP Solutions, four-year update, and Extended Life Cycle offerings. It supplies Vim 8.2.2637-20.el9_2.1 to remediate four Vim vulnerabilities including CVE-2026-33412.
RHSA-2026:6619 provided Vim 8.2.2637-16.el9_0.4 for RHEL 9.0 Update Services for SAP Solutions and related supported channels. The update fixes CVE-2026-25749, CVE-2026-28417, CVE-2026-28421, and CVE-2026-33412.
RHSA-2026:6617 supplied Vim 7.4.629-8.el7_9.1 for RHEL 7 ELS on x86_64, s390x, ppc64, and ppc64le. It addresses four Vim issues, including CVE-2026-33412 command injection in glob().
Red Hat issued RHSA-2026:6540 for RHEL 9.4 support channels, providing Vim 8.2.2637-20.el9_4.2. The update remediates the helpfile-processing, netrw command-injection, crafted-swap-file, and glob() command-injection flaws.
Red Hat published RHSA-2026:6539 for RHEL 9.6 Extended Update Support, supplying Vim 8.2.2637-22.el9_6.2 to address CVE-2026-25749, CVE-2026-28417, CVE-2026-28421, and CVE-2026-33412.
Red Hat issued RHSA-2026:6502 for RHEL 10.0 Extended Update Support and specified four-year support offerings, supplying Vim 9.1.083-5.el10_0.2. The update remediates CVE-2026-25749, CVE-2026-28417, CVE-2026-28421, and CVE-2026-33412.
Red Hat released OpenShift Container Platform 4.13.65 with updated packages and container images for the 4.13 stream. The release lists a fix for CVE-2026-33412 along with eight other CVEs affecting bundled components.
Vim versions before 9.2.0202 were vulnerable to arbitrary shell-command execution when an attacker could supply a glob pattern containing a newline on Unix-like systems. Exploitation depends on the user's configured shell; version 9.2.0202 fixes the issue tracked as CVE-2026-33412.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
15 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued **Important** security and bug-fix updates for OpenShift Container Platform 4.14, 4.15, 4.16, 4.17, and 4.18, including releases 4.14.65, 4.15.64, 4.16.60, 4.17.54, 4.18.39, and 4.18.43. The updates refresh platform packages and container images across x86_64, s390x, ppc64le, and aarch64 deployments, addressing vulnerabilities in OpenSSH, libarchive, libpng, nghttp2, Vim, GRUB2, OpenSSL, sudo, and the Linux kernel. Affected flaws include `CVE-2026-25646`, an out-of-bounds read in libpng's `png_set_quantize()` that can cause an infinite loop and read past a heap buffer, and `CVE-2026-28421`, in which crafted Vim swap files can trigger heap-buffer overflow and denial of service during recovery. Other remediated issues can enable arbitrary code execution, command injection, information disclosure, memory corruption, or denial of service; Red Hat advised OpenShift administrators to upgrade packages and release images through their appropriate release channels using the web console or OpenShift CLI.
Aug 26, 2026
Red Hat released updates for **Red Hat Enterprise Linux 8** to fix `CVE-2021-46939`, a moderate-severity Linux kernel tracing flaw that can recursively acquire a spin lock when tracing is re-entered through the function graph tracer. A local attacker or user able to trigger the affected tracing conditions could cause a system deadlock and denial of service, including during suspend/resume testing. Red Hat rated the issue CVSS 5.5; RHEL 9 is not affected, while RHEL 6 and 7 are outside the affected support scope. Red Hat also issued **RHSA-2024:5439** for OpenShift Container Platform 4.15, delivering version 4.15.28 with updated container images and packages. The release remediates the Linux kernel route-management use-after-free vulnerability `CVE-2024-36971`, Go `net/http` memory-exhaustion flaw `CVE-2023-45290`, and Go `net/netip` IPv4-mapped IPv6 address-handling issue `CVE-2024-24790`; it also updates Kubernetes to 1.28.12. OpenShift 4.15 customers on x86_64, s390x, ppc64le, and aarch64 should upgrade through their supported release channel or the OpenShift web console.
Aug 26, 2026
Red Hat released **Important** security updates for `gstreamer1-plugins-good` to fix multiple remote code execution vulnerabilities in GStreamer affecting Red Hat Enterprise Linux 8, 9, and 10. The flaws include **CVE-2026-18295** and **CVE-2026-18296**, both tied to MRF file parsing, **CVE-2026-18298**, a heap-based buffer overflow in PNG parsing, and **CVE-2026-18299**, a use-after-free in the `rtpsbcdepay` component. Red Hat said the bugs could allow arbitrary code execution in the context of the current process after user interaction, such as opening a malicious file or visiting a crafted page, and noted the issues were tracked by ZDI as `ZDI-CAN-29510`, `ZDI-CAN-29608`, `ZDI-CAN-29581`, and `ZDI-CAN-29787`. The fixes were shipped through advisories **RHSA-2026:59179** for RHEL 8, **RHSA-2026:59152** for RHEL 9, and **RHSA-2026:59133** for RHEL 10. Red Hat published updated package builds `1.16.1-7.el8_10.7` for RHEL 8, `1.22.12-7.el9_8.8` for RHEL 9, and `1.26.7-2.el10_2.7` for RHEL 10 across multiple architectures and lifecycle channels. RHEL 10 addresses the PNG and one MRF heap overflow issue, while RHEL 8 and RHEL 9 updates cover the broader set of four GStreamer RCE vulnerabilities.
Sep 1, 2026