ALAS2-2026-3804

References: CVE-2026-55693  CVE-2026-55895  CVE-2026-57456 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653. (CVE-2026-55693)

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663. (CVE-2026-55895)

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699. (CVE-2026-57456)

Issue Correction:
Run yum update vim or yum update --advisory ALAS2-2026-3804 to update your system.

New Packages:

aarch64:
    vim-common-9.0.2153-1.amzn2.0.8.aarch64
    vim-minimal-9.0.2153-1.amzn2.0.8.aarch64
    vim-enhanced-9.0.2153-1.amzn2.0.8.aarch64
    vim-X11-9.0.2153-1.amzn2.0.8.aarch64
    xxd-9.0.2153-1.amzn2.0.8.aarch64
    vim-debuginfo-9.0.2153-1.amzn2.0.8.aarch64

i686:
    vim-common-9.0.2153-1.amzn2.0.8.i686
    vim-minimal-9.0.2153-1.amzn2.0.8.i686
    vim-enhanced-9.0.2153-1.amzn2.0.8.i686
    vim-X11-9.0.2153-1.amzn2.0.8.i686
    xxd-9.0.2153-1.amzn2.0.8.i686
    vim-debuginfo-9.0.2153-1.amzn2.0.8.i686

noarch:
    vim-filesystem-9.0.2153-1.amzn2.0.8.noarch
    vim-data-9.0.2153-1.amzn2.0.8.noarch

src:
    vim-9.0.2153-1.amzn2.0.8.src

x86_64:
    vim-common-9.0.2153-1.amzn2.0.8.x86_64
    vim-minimal-9.0.2153-1.amzn2.0.8.x86_64
    vim-enhanced-9.0.2153-1.amzn2.0.8.x86_64
    vim-X11-9.0.2153-1.amzn2.0.8.x86_64
    xxd-9.0.2153-1.amzn2.0.8.x86_64
    vim-debuginfo-9.0.2153-1.amzn2.0.8.x86_64