ALAS2-2026-3882

References: CVE-2026-73072  CVE-2026-73074  CVE-2026-73076  CVE-2026-73077  CVE-2026-73078 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846. (CVE-2026-73072)

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841. (CVE-2026-73074)

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847. (CVE-2026-73076)

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839. (CVE-2026-73077)

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840. (CVE-2026-73078)

Issue Correction:
Run yum update vim or yum update --advisory ALAS2-2026-3882 to update your system.

New Packages:

aarch64:
    vim-common-9.0.2153-1.amzn2.0.10.aarch64
    vim-minimal-9.0.2153-1.amzn2.0.10.aarch64
    vim-enhanced-9.0.2153-1.amzn2.0.10.aarch64
    vim-X11-9.0.2153-1.amzn2.0.10.aarch64
    xxd-9.0.2153-1.amzn2.0.10.aarch64
    vim-debuginfo-9.0.2153-1.amzn2.0.10.aarch64

i686:
    vim-common-9.0.2153-1.amzn2.0.10.i686
    vim-minimal-9.0.2153-1.amzn2.0.10.i686
    vim-enhanced-9.0.2153-1.amzn2.0.10.i686
    vim-X11-9.0.2153-1.amzn2.0.10.i686
    xxd-9.0.2153-1.amzn2.0.10.i686
    vim-debuginfo-9.0.2153-1.amzn2.0.10.i686

noarch:
    vim-filesystem-9.0.2153-1.amzn2.0.10.noarch
    vim-data-9.0.2153-1.amzn2.0.10.noarch

src:
    vim-9.0.2153-1.amzn2.0.10.src

x86_64:
    vim-common-9.0.2153-1.amzn2.0.10.x86_64
    vim-minimal-9.0.2153-1.amzn2.0.10.x86_64
    vim-enhanced-9.0.2153-1.amzn2.0.10.x86_64
    vim-X11-9.0.2153-1.amzn2.0.10.x86_64
    xxd-9.0.2153-1.amzn2.0.10.x86_64
    vim-debuginfo-9.0.2153-1.amzn2.0.10.x86_64