Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47982 advisory.

    - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution       in C omni-completion
    - RHEL-201197 CVE-2026-59856 vim: potential command execution in       PHP omni-completion
    - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
    - RHEL-192113 CVE-2026-57456 vim: possible code execution with       python complete via crafted docstrings
    - RHEL-194062 CVE-2026-55693 vim: out-of-bounds write in       tree_count_words() and sug_filltree()
    - RHEL-186659 CVE-2026-47162 vim: code injection via       NetrwBookHistSave()
    - RHEL-186646 CVE-2026-52858 vim: possible code execution with       python3complete
    - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
    - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin
    - CVE-2026-41411 vim: Command injection via backticks in tag files

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48650 advisory.

    - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP       omni-completion
    - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution       during C omni-completion
    - RHEL-194059 CVE-2026-55693 vim: out-of-bounds write in tree_count_words()
    - RHEL-191359 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
    - RHEL-192105 CVE-2026-57456 vim: possible code execution with python complete
    - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave()
    - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete
    - RHEL-185867 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
    - RHEL-178233 CVE-2026-46483 vim: command injection in tar plugin

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47982 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47982 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3271-1 advisory.

    This update for vim fixes the following issues

    - Updated to version 9.2.0780.
    - CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
    - CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
    - CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3237-1 advisory.

    This update for vim fixes the following issues

    - Updated to version 9.2.0780.
    - CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
    - CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
    - CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21374-1 advisory.

    Update to version 9.2.0780.

    Security issues fixed:

    - CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
    - CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
    - CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

    Other updates and bugfixes:

    - Version 9.2.0780 changelog:
      * filetype detect missing from completion (9.2.0726).
      * popup images not rendered correctly when unfocused (9.2.0727).
      * filetype: supertux info pattern is relative to current dir         (9.2.0728).
      * % skips parens on continued quoted lines (9.2.0729).
      * GTK4 GUI tabline is not updated (9.2.0730).
      * GTK4 GUI scrollbar size not updated when restoring a session         (9.2.0731).
      * session: terminal restored using absolute columns/rows (9.2.0732).
      * GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
      * function pointer passed to STRNCMP() instead of a length         (9.2.0734).
      * tests: comment test can be improved (9.2.0737).
      * completion: 'autocompletedelay' blocks the main loop and drops         autocommands (9.2.0739).
      * GTK4: scrollbar wrongly displayed (9.2.0740).
      * complete_check() does not return TRUE for mapped input (9.2.0741).
      * filetype: SSH keys and related filetypes not recognized (9.2.0742).
      * string macros silently accept a size of the wrong type (9.2.0743).
      * popup_atcursor() closes immediately on white space (9.2.0744).
      * cscope: connection leak when growing the array fails (9.2.0747).
      * 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
      * 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
      * completion: 'autocompletedelay' deferral leaks state (9.2.0750).
      * GTK3 GUI is slow under Wayland (9.2.0751).
      * GTK4: drag-and-drop does not support HTML (9.2.0752).
      * GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
      * repeated completion length lookup in search_for_exact_line         (9.2.0754).
      * 'autocomplete' behaves inconsistently when recording (9.2.0755).
      * session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
      * tests: test_popupwin fails with zsh because of the prompt         (9.2.0757).
      * pum: no opacity when background not set for Popup menu group         (9.2.0758).
      * some code for 'autocompletedelay' is no longer needed (9.2.0759).
      * compiler warning for using potentially uninitialized var         (9.2.0760).
      * runtime(netrw): Unix: unable to open '\' file (9.2.0761).
      * duplicated sub-option name check in :set completion (9.2.0762).
      * tests: style issue in test_plugin_netrw (9.2.0763).
      * compiler warning about unused function (9.2.0764).
      * popup: opacity popup over a terminal is not cleared when moved         (9.2.0765).
      * quick_tab entries for empty letters point to the wrong index         (9.2.0766).
      * legacy/vim9cmd modifiers do not set script version for options         values (9.2.0767).
      * legacy/vim9cmd modifiers are not exclusive (9.2.0768).
      * conversion to utf-16be using iconv is inconsistent (9.2.0769).
      * dict_add_dict() has inconsistent ownership on failure (9.2.0770).
      * dict_add_list() has inconsistent ownership on failure (9.2.0771).
      * Vim9: null dereference inside alloc_type() (9.2.0772).
      * memory leak in evalfunc.c on alloc failure (9.2.0773).
      * memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
      * memory leak in highlight_get_info() on alloc failure (9.2.0775).
      * memory leak in sign_getlist() on alloc failure (9.2.0776).
      * memory leak in add_defer() on alloc failure (9.2.0777).
      * memory leak in compile_dict() on alloc failure (9.2.0778).
      * memory leak in type_name_func() on alloc failure (9.2.0779).
      * memory leak in evalvars.c on alloc failure (9.2.0780).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8541-1 advisory.

    Hirohito Higashi discovered that Vim incorrectly escaped class or trait names when performing PHP omni-     completion. An attacker could possibly use this issue to trick a user into opening a specially crafted PHP     file and executing arbitrary commands. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and     Ubuntu 26.04 LTS. (CVE-2026-59856)

    Hirohito Higashi discovered that Vim incorrectly handled sound-folding of certain words when using a spell     file. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service.
    (CVE-2026-59857)

    It was discovered that Vim incorrectly escaped certain tags file fields when performing C omni-completion.
    An attacker could possibly use this issue to trick a user into opening a specially crafted file and     executing arbitrary commands. (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in     runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry,     without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as     a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command;
    opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion     runs that command as the editing user. This issue is fixed in version 9.2.0735. (CVE-2026-59858)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
331326	Oracle Linux 9 : vim (ELSA-2026-47982)	Nessus	Oracle Linux Local Security Checks	high
331298	Oracle Linux 10 : vim (ELSA-2026-48650)	Nessus	Oracle Linux Local Security Checks	high
330849	RHEL 9 : vim (RHSA-2026:47982)	Nessus	Red Hat Local Security Checks	high
330839	RockyLinux 9 : vim (RLSA-2026:47982)	Nessus	Rocky Linux Local Security Checks	high
330311	SUSE SLES15 Security Update : vim (SUSE-SU-2026:3271-1)	Nessus	SuSE Local Security Checks	high
330289	SUSE SLES12 Security Update : vim (SUSE-SU-2026:3237-1)	Nessus	SuSE Local Security Checks	high
328920	openSUSE 16 Security Update : vim (openSUSE-SU-2026:21374-1)	Nessus	SuSE Local Security Checks	high
327061	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Vim vulnerabilities (USN-8541-1)	Nessus	Ubuntu Local Security Checks	high
326292	Linux Distros Unpatched Vulnerability : CVE-2026-59858	Nessus	Misc.	high

Detections

Analytics

CVE-2026-59858

high

Tenable Plugins

high

high

high

high

high

high

high

high

high