Status: UPDATED
| Advisory ID: CVE-2026-43961
Key Details
| CVE | CVE-2026-43961 |
| CVSS Score / Version | 7.8 (High) / CVSS v3.1 |
| Updated | 2026-09-22 |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat Hardened Images, and vim vim |
| Classified as | CWE-94 (Improper Control of Generation of Code ('Code Injection')) |
| Exploitation prediction (EPSS) | 0.22% probability of exploitation in the next 30 days (11% percentile) -- FIRST.org's EPSS model. |
Affected Products, Subsystems & Sectors
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
What to Know
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim. (NVD)
What to Do
Monitor Red Hat's and vim's web pages for any future patch releases.
References