RHSA-2026:74364

Vulnerability from csaf_redhat - Published: 2026-10-01 05:28 - Updated: 2026-10-01 17:13
Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (CUDA 12.9)
Severity
Important
Notes
Topic: Red Hat AI Base Images 3.3.4 (CUDA 12.9) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Low
CVE-2026-11822

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-11824

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-16118

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-47162

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-47167

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user's system.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-52858

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-54369

A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-55693

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-57455

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-57456

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-59856

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-59858

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.

6.5 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-64830

A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg's VobSub demuxer. This could allow an attacker to take control of the affected system.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73066

A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73072

A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73076

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73077

A vulnerability in Vim's shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73078

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:74364 self
https://access.redhat.com/security/cve/CVE-2025-6170 external
https://access.redhat.com/security/cve/CVE-2026-11822 external
https://access.redhat.com/security/cve/CVE-2026-11824 external
https://access.redhat.com/security/cve/CVE-2026-16118 external
https://access.redhat.com/security/cve/CVE-2026-47162 external
https://access.redhat.com/security/cve/CVE-2026-47167 external
https://access.redhat.com/security/cve/CVE-2026-52858 external
https://access.redhat.com/security/cve/CVE-2026-54369 external
https://access.redhat.com/security/cve/CVE-2026-55693 external
https://access.redhat.com/security/cve/CVE-2026-57455 external
https://access.redhat.com/security/cve/CVE-2026-57456 external
https://access.redhat.com/security/cve/CVE-2026-59856 external
https://access.redhat.com/security/cve/CVE-2026-59858 external
https://access.redhat.com/security/cve/CVE-2026-64830 external
https://access.redhat.com/security/cve/CVE-2026-73066 external
https://access.redhat.com/security/cve/CVE-2026-73072 external
https://access.redhat.com/security/cve/CVE-2026-73076 external
https://access.redhat.com/security/cve/CVE-2026-73077 external
https://access.redhat.com/security/cve/CVE-2026-73078 external
https://access.redhat.com/security/updates/classi… external
https://www.redhat.com/en/products/ai external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-6170 self
https://bugzilla.redhat.com/show_bug.cgi?id=2372952 external
https://www.cve.org/CVERecord?id=CVE-2025-6170 external
https://nvd.nist.gov/vuln/detail/CVE-2025-6170 external
https://gitlab.gnome.org/GNOME/libxml2/-/issues/941 external
https://access.redhat.com/security/cve/CVE-2026-11822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487258 external
https://www.cve.org/CVERecord?id=CVE-2026-11822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11822 external
https://sqlite.org/releaselog/3_53_2.html external
https://sqlite.org/src/info/061febcf41ca external
https://sqlite.org/src/info/4a5ad516ea93 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-11824 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487269 external
https://www.cve.org/CVERecord?id=CVE-2026-11824 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11824 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-16118 self
https://bugzilla.redhat.com/show_bug.cgi?id=2501732 external
https://www.cve.org/CVERecord?id=CVE-2026-16118 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16118 external
https://gitlab.freedesktop.org/xdg/xdgmime/-/work… external
https://access.redhat.com/security/cve/CVE-2026-47162 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487964 external
https://www.cve.org/CVERecord?id=CVE-2026-47162 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47162 external
https://github.com/vim/vim/commit/f08ab2f4d7d2947… external
https://github.com/vim/vim/releases/tag/v9.2.0495 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-47167 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487996 external
https://www.cve.org/CVERecord?id=CVE-2026-47167 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47167 external
https://github.com/vim/vim/commit/a65a52d684bc585… external
https://github.com/vim/vim/releases/tag/v9.2.0496 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-52858 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487981 external
https://www.cve.org/CVERecord?id=CVE-2026-52858 external
https://nvd.nist.gov/vuln/detail/CVE-2026-52858 external
https://github.com/vim/vim/commit/4b850457e12e1a6… external
https://github.com/vim/vim/releases/tag/v9.2.0561 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-54369 self
https://bugzilla.redhat.com/show_bug.cgi?id=2490277 external
https://www.cve.org/CVERecord?id=CVE-2026-54369 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54369 external
https://access.redhat.com/security/cve/CVE-2026-55693 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492980 external
https://www.cve.org/CVERecord?id=CVE-2026-55693 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55693 external
https://github.com/vim/vim/commit/a80874d9b84a010… external
https://github.com/vim/vim/releases/tag/v9.2.0653 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-57455 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492968 external
https://www.cve.org/CVERecord?id=CVE-2026-57455 external
https://nvd.nist.gov/vuln/detail/CVE-2026-57455 external
https://github.com/vim/vim/commit/497f931f85339d1… external
https://github.com/vim/vim/releases/tag/v9.2.0698 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-57456 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492972 external
https://www.cve.org/CVERecord?id=CVE-2026-57456 external
https://nvd.nist.gov/vuln/detail/CVE-2026-57456 external
https://github.com/vim/vim/commit/cce141c42740f12… external
https://github.com/vim/vim/releases/tag/v9.2.0699 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-59856 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498867 external
https://www.cve.org/CVERecord?id=CVE-2026-59856 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59856 external
https://github.com/vim/vim/commit/43afc581a37a357… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-59858 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498868 external
https://www.cve.org/CVERecord?id=CVE-2026-59858 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59858 external
https://github.com/vim/vim/commit/6b611b0d15603c5… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-64830 self
https://bugzilla.redhat.com/show_bug.cgi?id=2506193 external
https://www.cve.org/CVERecord?id=CVE-2026-64830 external
https://nvd.nist.gov/vuln/detail/CVE-2026-64830 external
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd4… external
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657 external
https://www.vulncheck.com/advisories/ffmpeg-heap-… external
https://access.redhat.com/security/cve/CVE-2026-73066 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514011 external
https://www.cve.org/CVERecord?id=CVE-2026-73066 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73066 external
https://github.com/tesseract-ocr/tesseract/commit… external
https://github.com/tesseract-ocr/tesseract/pull/4588 external
https://github.com/tesseract-ocr/tesseract/releas… external
https://github.com/tesseract-ocr/tesseract/securi… external
https://access.redhat.com/security/cve/CVE-2026-73072 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514037 external
https://www.cve.org/CVERecord?id=CVE-2026-73072 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73072 external
https://github.com/vim/vim/commit/05c41c922309c7a… external
https://github.com/vim/vim/releases/tag/v9.2.0846 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-73076 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514034 external
https://www.cve.org/CVERecord?id=CVE-2026-73076 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73076 external
https://github.com/vim/vim/commit/581a2f3ac9c6f96… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-73077 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514065 external
https://www.cve.org/CVERecord?id=CVE-2026-73077 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73077 external
https://github.com/vim/vim/commit/c5a82fe013e73c9… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-73078 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514058 external
https://www.cve.org/CVERecord?id=CVE-2026-73078 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73078 external
https://github.com/vim/vim/commit/29c6fd090d45205… external
https://github.com/vim/vim/security/advisories/GH… external
Acknowledgments
Ahmed Lekssays
asotyc
Andrew Tridgell <tridge60@gmail.com> Alexander Peslyak <solar@openwall.com>
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Base Images 3.3.4 (CUDA 12.9) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Base Images",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:74364",
        "url": "https://access.redhat.com/errata/RHSA-2026:74364"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-6170",
        "url": "https://access.redhat.com/security/cve/CVE-2025-6170"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11822",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11822"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11824",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11824"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16118",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-47162",
        "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-47167",
        "url": "https://access.redhat.com/security/cve/CVE-2026-47167"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-52858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-52858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54369",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54369"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55693",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57455",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57456",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59856",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-64830",
        "url": "https://access.redhat.com/security/cve/CVE-2026-64830"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73066",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73066"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73072",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73072"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73076",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73076"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73077",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73077"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73078",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73078"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai",
        "url": "https://www.redhat.com/en/products/ai"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74364.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (CUDA 12.9)",
    "tracking": {
      "current_release_date": "2026-10-01T17:13:57+00:00",
      "generator": {
        "date": "2026-10-01T17:13:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:74364",
      "initial_release_date": "2026-10-01T05:28:34+00:00",
      "revision_history": [
        {
          "date": "2026-10-01T05:28:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-01T05:28:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-01T17:13:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift AI 3.3",
                "product": {
                  "name": "Red Hat OpenShift AI 3.3",
                  "product_id": "Red Hat OpenShift AI 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_ai:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift AI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64",
                  "product_id": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-cuda-12.9-rhel9@sha256%3A748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-cuda-12.9-rhel9\u0026tag=1790703608"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
                  "product_id": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-cuda-12.9-rhel9@sha256%3A49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47?arch=arm64\u0026repository_url=registry.redhat.io/rhai/base-image-cuda-12.9-rhel9\u0026tag=1790703608"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64 as a component of Red Hat OpenShift AI 3.3",
          "product_id": "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64 as a component of Red Hat OpenShift AI 3.3",
          "product_id": "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ahmed Lekssays"
          ]
        }
      ],
      "cve": "CVE-2025-6170",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2025-06-16T05:33:22.955000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has rated the severity of this vulnerability as Low, since it affects only the interactive shell mode of the xmllint tool and requires a user to manually run the tool and enter or receive specially crafted input. The exploitation requires local access and a highly specific usage scenario that is uncommon in typical environments. While it can cause a crash, the impact is limited to availability, and exploitation is unlikely in real-world deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-6170"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
        }
      ],
      "release_date": "2025-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling"
    },
    {
      "cve": "CVE-2026-11822",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-09T20:01:15.006955+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
        }
      ],
      "release_date": "2026-06-09T19:08:31.019000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
    },
    {
      "cve": "CVE-2026-11824",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-06-09T20:02:19.874232+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487269"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487269",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
        }
      ],
      "release_date": "2026-06-09T19:21:42.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "asotyc"
          ]
        }
      ],
      "cve": "CVE-2026-16118",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-07-17T13:20:23.862000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501732"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to install a malicious MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) and process it with an application performing MIME type detection, limiting its exposure. Also, only little-endian systems are vulnerable. Due to these reasons, this issue has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16118"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501732",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16118"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41",
          "url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
        }
      ],
      "release_date": "2026-07-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Do not install a MIME magic file or content from untrusted sources.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c"
    },
    {
      "cve": "CVE-2026-47162",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-06-11T19:00:56.050612+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via crafted directory names",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47162",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
          "url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0495",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
        }
      ],
      "release_date": "2026-06-11T18:32:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via crafted directory names"
    },
    {
      "cve": "CVE-2026-47167",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:02:45.999423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487996"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted step-definition patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487996",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487996"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47167",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
          "url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0496",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
        }
      ],
      "release_date": "2026-06-11T18:31:44.286000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted step-definition patterns"
    },
    {
      "cve": "CVE-2026-52858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:01:57.042099+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487981"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user\u0027s system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487981",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487981"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-52858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
          "url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0561",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
        }
      ],
      "release_date": "2026-06-11T18:32:32.722000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via Python omni-completion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Andrew Tridgell \u003ctridge60@gmail.com\u003e",
            "Alexander Peslyak \u003csolar@openwall.com\u003e"
          ]
        }
      ],
      "cve": "CVE-2026-54369",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-06-16T23:47:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acl: Symlink traversal privilege escalation via libacl functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54369"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490277",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
        }
      ],
      "release_date": "2026-06-29T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "acl: Symlink traversal privilege escalation via libacl functions"
    },
    {
      "cve": "CVE-2026-55693",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-25T16:02:21.870241+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        }
      ],
      "release_date": "2026-06-25T15:34:33.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
    },
    {
      "cve": "CVE-2026-57455",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-25T16:01:18.343208+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492968"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492968",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        }
      ],
      "release_date": "2026-06-25T15:22:37.949000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
    },
    {
      "cve": "CVE-2026-57456",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-25T16:01:37.648886+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        }
      ],
      "release_date": "2026-06-25T15:16:16.015000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
    },
    {
      "cve": "CVE-2026-59856",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:40.406872+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        }
      ],
      "release_date": "2026-07-09T22:39:01.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
    },
    {
      "cve": "CVE-2026-59858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:43.278752+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        }
      ],
      "release_date": "2026-07-09T22:37:52.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
    },
    {
      "cve": "CVE-2026-64830",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-22T18:01:30.962327+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg\u0027s VobSub demuxer. This could allow an attacker to take control of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap buffer overflow in FFmpeg\u0027s VobSub subtitle demuxer can lead to arbitrary code execution when processing a specially crafted subtitle file. Exploitation requires user interaction, such as opening a malicious media file, which reduces the attack surface but can result in high impact if an affected application processes untrusted content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64830",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951",
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951"
        },
        {
          "category": "external",
          "summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657",
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer",
          "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"
        }
      ],
      "release_date": "2026-07-22T16:33:05.724000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing VobSub subtitle files from untrusted or unknown sources. For applications that utilize FFmpeg\u0027s VobSub demuxer, consider running them within a sandboxed environment to restrict the potential impact of a successful exploit.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer."
    },
    {
      "cve": "CVE-2026-73066",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-11T15:01:14.226581+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract\u0027s deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73066"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73066",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73066"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72",
          "url": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/pull/4588",
          "url": "https://github.com/tesseract-ocr/tesseract/pull/4588"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3",
          "url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8",
          "url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8"
        }
      ],
      "release_date": "2026-08-11T14:49:16.817000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing `.traineddata` files from untrusted sources with Tesseract. Ensure that only `.traineddata` files from known, reputable origins are used for OCR recognition.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata"
    },
    {
      "cve": "CVE-2026-73072",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-11T15:41:15.596551+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Heap buffer overflow allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A local attacker can exploit an Important heap buffer overflow in Vim to execute arbitrary code by tricking a user into loading a malicious spell file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73072",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
          "url": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0846",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0846"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
        }
      ],
      "release_date": "2026-08-11T15:31:35.331000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim\u2019s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Heap buffer overflow allows arbitrary code execution"
    },
    {
      "cve": "CVE-2026-73076",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T15:41:02.894650+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514034"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted vimball",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim where a crafted vimball can lead to arbitrary command execution. The flaw allows an attacker to embed malicious commands within a `.VimballRecord` file, which are then executed with user privileges during a later, unrelated vimball installation or removal. This extends the impact of processing untrusted vimball files beyond the initial installation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514034",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514034"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452",
          "url": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
        }
      ],
      "release_date": "2026-08-11T15:37:59.894000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted vimball"
    },
    {
      "cve": "CVE-2026-73077",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T16:11:25.535913+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514065"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Vim\u0027s shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s shell plugins allows full system compromise in Red Hat environments if a user selects crafted text in Visual mode and triggers a keyword lookup. This does not affect RHEL 8 and older versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514065",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514065"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73077",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
          "url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
        }
      ],
      "release_date": "2026-08-11T15:39:24.579000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory:\n\n- `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=`\n\nThis change takes effect the next time a shell script is opened in Vim.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling"
    },
    {
      "cve": "CVE-2026-73078",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T16:10:59.827742+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514058"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Vim\u0027s netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s `netrw` plugin allows for arbitrary command execution in GUI Vim. By crafting a malicious directory path, an attacker could exploit improper neutralization of special characters when the path is browsed or bookmarked, leading to command injection. This issue specifically impacts GUI installations and requires user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
          "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514058",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514058"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73078",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
          "url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
        }
      ],
      "release_date": "2026-08-11T15:41:08.048000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T05:28:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74364",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74364"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.",
          "product_ids": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:49261adff13799b201bbf8e75ffdc3f4a1423c6ab442bcce6955490c8b2a2a47_arm64",
            "Red Hat OpenShift AI 3.3:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:748bfc61bc817f351bb23ede5aa917ef63da0099008557b1b505f36d663c2e40_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.