Critical Command Execution Vulnerability in Vim Package
Summary
RLSA-2026:77359: Important: vim security update. Affects vim versions < 2:8.0.1763-32.el8_10. Fixed in 2:8.0.1763-32.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim, short for Vi IMproved, is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. However, a recent security vulnerability has been identified that allows for arbitrary command execution through a crafted tags file during C omni-completion, posing significant risks to users.
Vulnerability Detail
The vulnerability, identified as CVE-2026-73073, arises from improper handling of crafted tags files in Vim's C omni-completion feature. An attacker can exploit this flaw to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. The severity of this vulnerability is underscored by its CVSS score of 7.3, indicating a high level of risk.
How To Fix
Minimum fixed version
2:8.0.1763-32.el8_10
This is the first release that contains the fix.
sudo dnf update vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the C omni-completion feature in Vim until the package is updated. This can be done by modifying the Vim configuration file (usually located at ~/.vimrc) and adding the following line: 'set complete-=i'. This will prevent the use of omni-completion for C files.
Conclusion
The discovery of CVE-2026-73073 in the Vim package highlights the importance of maintaining up-to-date software to protect against security vulnerabilities. Users are strongly advised to update their Vim installations to the latest patched version to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for vim →
FAQ
CVE-2026-73073 is a security vulnerability in the Vim text editor that allows for arbitrary command execution via crafted tags files during C omni-completion.
You can check if your Vim installation is affected by using tools like Vulert, which monitors open-source vulnerabilities. You can also manually verify your Vim version against the patched version.
The risks include unauthorized command execution, potential data breaches, and system compromise, which can lead to significant security incidents.
Yes, a patch is available. Users should update to version 2:8.0.1763-32.el8_10 to mitigate the risk.
You can use Vulert, which requires only a manifest file like package-lock.json to monitor and alert for open-source vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
