7.8Yüksek

CVE-2026-43961Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

vim vim; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Hardened Images; Red Hat Red Hat Enterprise Linux 10 Yayım: 2026-08-19 17:06 (2 ay önce)

Açıklama

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Zayıflık türü (CWE): CWE-94

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
enterprise linux	8	—
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Hardened Images	all versions
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 5	—
vim	vim	< 9.2.0480

Kaynaklar ve yamalar

RHSA-2026:57614 vendor-advisory
RHSA-2026:98119 vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-43961 vdb-entry
RHBZ#2460434 issue-tracking
https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
http://www.openwall.com/lists/oss-security/2026/05/14/7

CVSS puanı

7.8Yüksek

Kaynak: redhat · CVSS 3.1

Saldırı yolu: Yerel
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tüm puanlar (2)

cna	CVSS 3.1	7.8Yüksek
secalert@redhat.com	CVSS 3.1	7.8Yüksek

EPSS (30 günde istismar olasılığı)

0.16%

tüm CVE'lerin %5'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-05-04
Yayımlandı2026-08-19 17:06
IP-DB'ye ulaştı2026-10-24 23:48
Son güncelleme2026-11-11 09:17

Numarayı veren (CNA): redhat
NVD durumu: Awaiting Analysis

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Red Hat Enterprise Linux

7.6Yüksek

CVE-2026-124741 2 saat önce

Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, tr…

7.5Yüksek

CVE-2026-124739 2 saat önce

Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could explo…

7.5Yüksek

CVE-2026-124737 3 saat önce

Busybox: heap buffer overflow in the tftp client on fallback to the default block size

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP serv…

6.5Orta

CVE-2026-121885 22 saat önce

Podman: untrusted image labels allow auto-update to restart arbitrary systemd units

podman; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart.…

7.5Yüksek

CVE-2026-124747 23 saat önce

Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP s…

4.2Orta

CVE-2026-125709 dün

Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigg…