Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

vim can execute code from a crafted tags file

published 29 days ago

Summary

The vim editor on Rocky Linux can be tricked by a specially prepared tags file used for C language auto-completion to run any command the attacker chooses. This could let an attacker gain the same rights as the user running vim and potentially compromise the system. Apply the latest Rocky Linux vim update or avoid using untrusted tags files to stay protected.

What to do

Update rocky vim to version 2:9.1.083-9.el10_2.22.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:10	rocky	vim	< 2:9.1.083-9.el10_2.22 Fix: upgrade to 2:9.1.083-9.el10_2.22

Original advisory text

Important: vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-73073)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:75769 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517950 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:75769 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.3 High

Timeline

Published6 Oct 2026

Updated6 Oct 2026

First seen6 Oct 2026

Sources

RLSA-2026:75769 · OSV

Track software like this

Free during beta