ALAS2023-2026-1993

References: CVE-2026-59856  CVE-2026-59857  CVE-2026-59858 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736. (CVE-2026-59856)

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725. (CVE-2026-59857)

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735. (CVE-2026-59858)

Issue Correction:
Run dnf update vim --releasever 2023.12.20260803 or dnf update --advisory ALAS2023-2026-1993 --releasever 2023.12.20260803 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    vim-enhanced-debuginfo-9.2.780-1.amzn2023.0.1.aarch64
    xxd-debuginfo-9.2.780-1.amzn2023.0.1.aarch64
    vim-debuginfo-9.2.780-1.amzn2023.0.1.aarch64
    vim-minimal-9.2.780-1.amzn2023.0.1.aarch64
    vim-minimal-debuginfo-9.2.780-1.amzn2023.0.1.aarch64
    xxd-9.2.780-1.amzn2023.0.1.aarch64
    vim-enhanced-9.2.780-1.amzn2023.0.1.aarch64
    vim-debugsource-9.2.780-1.amzn2023.0.1.aarch64
    vim-common-9.2.780-1.amzn2023.0.1.aarch64

noarch:
    vim-data-9.2.780-1.amzn2023.0.1.noarch
    vim-filesystem-9.2.780-1.amzn2023.0.1.noarch
    vim-default-editor-9.2.780-1.amzn2023.0.1.noarch

src:
    vim-9.2.780-1.amzn2023.0.1.src

x86_64:
    xxd-debuginfo-9.2.780-1.amzn2023.0.1.x86_64
    vim-minimal-debuginfo-9.2.780-1.amzn2023.0.1.x86_64
    xxd-9.2.780-1.amzn2023.0.1.x86_64
    vim-debugsource-9.2.780-1.amzn2023.0.1.x86_64
    vim-minimal-9.2.780-1.amzn2023.0.1.x86_64
    vim-enhanced-9.2.780-1.amzn2023.0.1.x86_64
    vim-debuginfo-9.2.780-1.amzn2023.0.1.x86_64
    vim-common-9.2.780-1.amzn2023.0.1.x86_64
    vim-enhanced-debuginfo-9.2.780-1.amzn2023.0.1.x86_64