Critical Security Flaw in Vim: Arbitrary Command Execution Vulnerability
Summary
RLSA-2026:75769: Important: vim security update. Affects vim versions < 2:9.1.083-9.el10_2.22. Fixed in 2:9.1.083-9.el10_2.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim, short for Vi IMproved, is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. However, a recent security vulnerability has been identified that allows for arbitrary command execution through a crafted tags file in C omni-completion, potentially compromising system integrity.
Vulnerability Detail
The vulnerability, identified as CVE-2026-73073, arises from improper handling of crafted tags files within Vim's C omni-completion feature. This flaw could allow an attacker to execute arbitrary commands on a victim's system, leading to unauthorized access, data loss, or system compromise. The severity of this vulnerability is underscored by its CVSS score of 7.3, indicating a high level of risk to users who have not updated to the patched version.
How To Fix
Minimum fixed version
2:9.1.083-9.el10_2.22
This is the first release that contains the fix.
sudo dnf update vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the C omni-completion feature until they have updated to the patched version. This can help mitigate the risk of exploitation while waiting for the update to be applied.
Conclusion
The discovery of CVE-2026-73073 in Vim highlights the importance of maintaining up-to-date software to protect against potential security threats. Users are strongly encouraged to apply the necessary updates to safeguard their systems from arbitrary command execution vulnerabilities.
See every vulnerability recorded for vim →
FAQ
CVE-2026-73073 is a security vulnerability in Vim that allows for arbitrary command execution via crafted tags files in C omni-completion.
You can check your Vim version by running 'vim --version' in your terminal. If it is below 2:9.1.083-9.el10_2.22, it is affected.
If you cannot update Vim right away, avoid using the C omni-completion feature to reduce the risk of exploitation.
More details can be found on the CVE page for CVE-2026-73073 or by visiting security advisories from the Rocky Enterprise Software Foundation.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
