The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66366 advisory.

    * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal     emulator (CVE-2026-28420)

    * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

    * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

    * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

    * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

    * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

    * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

    * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the vim-8.2.2637-41.el9 build changelog.

  - out-of-bounds read in update_snapshot() (CVE-2026-52859)

  - buffer overflow in terminal emulator (CVE-2026-28420)

  - stack out-of-bounds write in dump_prefixes() (CVE-2026-55892)

  - stack out-of-bounds write in spell_soundfold_sal() (CVE-2026-59857)

  - heap buffer overflow in set_sofo() (CVE-2026-73072)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0840. It is, therefore, affected by a vulnerability as referenced in the GHSA-rcr7-f3wr-22r2 advisory.

  - runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs     Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed     :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt()     fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path     browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. (CVE-2026-73078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72465 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)

    * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)

    * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

    * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

    * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

    * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

    * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1367 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-34982:
    Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in     Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip     and printheader options are missing the P_MLE flag, allowing a modeline to be executed. Additionally, the     mapset() function lacks a check_secure() call, allowing it to be abused from sandboxed expressions. Commit     9.2.0276 fixes the issue.

    CVE-2026-35177:
    Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's     zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives,     circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.

    CVE-2026-41411:
    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., command), Vim executes the embedded command via the system shell with the full     privileges of the running user.

    CVE-2026-46483:
    Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability     exists in tar#Vimuntar() in     runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds     :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted     archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's     context. This vulnerability is fixed in 9.2.0479.

    CVE-2026-47162:
    Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection     vulnerability exists in s:NetrwBookHistSave() in the netrw plugin     (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history     file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted     Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to     break out of the string context and execute arbitrary Vimscript, including shell commands via system() and     :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.

    CVE-2026-47167:
    Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability     exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with     +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or     stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing     a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary     shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version     9.2.0496.

    CVE-2026-52858:
    Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion     script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy     pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found     in the current buffer through Python's import machinery. Because the buffer's working directory is on     sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that     package's top-level code as the editing user. This issue has been patched in version 9.2.0561.

    CVE-2026-55693:
    Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in     src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a     depth counter. The counter is bounded only by the trie structure itself; it is never checked against the     size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted     .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that     corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

    CVE-2026-57455:
    Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of     spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte     map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and     terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer     the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell     suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer.
    This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This     vulnerability is fixed in 9.2.0698.

    CVE-2026-57456:
    Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion     (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function     and class definitions from the current buffer with exec() as part of populating the completion dictionary.
    When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no     escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled     Python during omni-completion. This vulnerability is fixed in 9.2.0699.

    CVE-2026-59858:
    Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in     runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry,     without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as     a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command;
    opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion     runs that command as the editing user. This issue is fixed in version 9.2.0735.

    CVE-2026-73072:
    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses     sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an     SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes     beyond a heap allocation. This issue is fixed in version 9.2.0846.

    CVE-2026-73076:
    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a     crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen     commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands,     including operating-system commands invoked through :!, execute with the privileges of the user running     Vim. This issue is fixed in version 9.2.0847.

    CVE-2026-73078:
    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads     netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu     entries by interpolating attacker-controlled directory paths into executed :menu commands.
    s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to     neutralize the | command separator or single quotes at five construction sites, allowing a crafted path     browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is     fixed in version 9.2.0840.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression     fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript     execution. This can be leveraged to run shell commands with the privileges of the user running     Vim.(CVE-2026-43961)

    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses     sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an     SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes     beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)

    Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in     runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped     typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command     separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with     CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in     version 9.2.0845.(CVE-2026-73073)

    Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in     src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free     the current buffer, causing the error path to read freed memory instead of reader-js_buf + reader-     js_used when an invalid JSON string spans buffers. This issue is fixed in version     9.2.0844.(CVE-2026-73071)

    Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim,     runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-     mode selections from K through keywordprg commands without safely separating shell arguments.
    fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg,     ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands     to execute with the privileges of the user running Vim. This issue is fixed in version     9.2.0839.(CVE-2026-73077)

    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a     crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen     commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands,     including operating-system commands invoked through :!, execute with the privileges of the user running     Vim. This issue is fixed in version 9.2.0847.(CVE-2026-73076)

    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads     netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu     entries by interpolating attacker-controlled directory paths into executed :menu commands.
    s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to     neutralize the | command separator or single quotes at five construction sites, allowing a crafted path     browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is     fixed in version 9.2.0840.(CVE-2026-73078)

    Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability     exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with     +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or     stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing     a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary     shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version     9.2.0496.(CVE-2026-47167)

    Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses     the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the     count to zero and copying existing text-property records into a heap allocation sized for none of them.
    This issue is fixed in version 9.2.0841.(CVE-2026-73074)

Tenable has extracted the preceding description block directly from the EulerOS vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1763 advisory.

    This advisory aggregates security fixes for the vim SRPM in CIQ LTS 8.6. It addresses 22 CVEs:
    CVE-2026-33412, CVE-2026-55892, CVE-2026-59858, CVE-2026-35177, CVE-2026-57456, and 17 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
344839	RockyLinux 9 : vim (RLSA-2026:66366)	Nessus	Rocky Linux Local Security Checks	2026/9/11	2026/10/7	high
348806	CentOS 9 : vim-8.2.2637-41.el9	Nessus	CentOS Local Security Checks	2026/9/22	2026/10/7	high
335164	Vim < 9.2.0840 Arbitrary Code Execution (GHSA-rcr7-f3wr-22r2)	Nessus	Misc.	2026/8/13	2026/10/16	high
350995	RHEL 9 : vim (RHSA-2026:72465)	Nessus	Red Hat Local Security Checks	2026/9/29	2026/10/7	high
375717	TencentOS Server 2: vim (TSSA-2026:1367)	Nessus	Tencent Local Security Checks	2026/11/4	2026/11/4	high
376864	EulerOS 2.0 SP12 : vim (EulerOS-SA-2026-4462)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	high
376878	EulerOS 2.0 SP12 : vim (EulerOS-SA-2026-4539)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	high
377501	Rocky Linux 8.6 [CIQ] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ciqsa-2026_1763)	Nessus	Rocky Linux Local Security Checks	2026/11/7	2026/11/7	high

検出

プラグインの検索

high

high

high

high

high

high

high

high