SUSE-SU-2026:1387-1

HIGH8.6

Security update for vim

Published Apr 16, 2026

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for vim fixes the following issues:

Update to version 9.2.0280.

CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).

Affected Packages

gvim

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP4

Fixed in:

9.2.0280-150000.5.89.1

vim

Fixed in:

9.2.0280-150000.5.89.1

vim-data

Fixed in:

9.2.0280-150000.5.89.1

vim-data-common

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Micro 5.2SUSE Linux Enterprise Micro 5.3SUSE Linux Enterprise Micro 5.4

Fixed in:

9.2.0280-150000.5.89.1

vim-small

Fixed in:

9.2.0280-150000.5.89.1

References

ADVISORY

https://bugzilla.suse.com/1259985

ADVISORY

https://bugzilla.suse.com/1261191

ADVISORY

https://bugzilla.suse.com/1261271