CVE-2026-43961: Red Hat Enterprise Linux 10

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 6
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Hardened Images: before 9.2.967-1.1.hum1 (fixed in 9.2.967-1.1.hum1)
• Red Hat Red Hat Openshift Container Platform 4
• Vim Vim: before 9.2.0480 (fixed in 9.2.0480)

Published 2026-08-19. Last modified 2026-09-22.