CVE-2026-34714
vim: Vim: Arbitrary code execution via crafted file
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 31, 2026
Updated · November 5, 2026
Description
A flaw was found in Vim. This vulnerability allows an attacker to execute malicious code on a user's system. This occurs when a user opens a specially crafted file, leading to immediate code execution due to a vulnerability in how Vim handles expressions within its tabpanel feature.
Statement
The vulnerable functionality (tabpanel) was introduced in upstream Vim beginning with patch 9.1.1391. The versions of Vim provided in RHEL, including RHEL 10 (9.1.083) and earlier releases, are based on versions prior to this change and do not include the affected code. As a result, Red Hat Enterprise Linux is not impacted.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement