Linux · Amazon Linux · Security advisory · June 22, 2026

ALAS2023-2026-1862: Security update for 12 packages

ALAS2023-2026-1862, released June 22, 2026, fixes 12 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0092
60th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 9 Routine 3

Fixed package versions

ProductReleaseFixed in
vim-commonamzn 20232:9.2.597-1.amzn2023.0.1
vim-dataamzn 20232:9.2.597-1.amzn2023.0.1
vim-debuginfoamzn 20232:9.2.597-1.amzn2023.0.1
vim-debugsourceamzn 20232:9.2.597-1.amzn2023.0.1
vim-default-editoramzn 20232:9.2.597-1.amzn2023.0.1
vim-enhancedamzn 20232:9.2.597-1.amzn2023.0.1
vim-enhanced-debuginfoamzn 20232:9.2.597-1.amzn2023.0.1
vim-filesystemamzn 20232:9.2.597-1.amzn2023.0.1
vim-minimalamzn 20232:9.2.597-1.amzn2023.0.1
vim-minimal-debuginfoamzn 20232:9.2.597-1.amzn2023.0.1
xxdamzn 20232:9.2.597-1.amzn2023.0.1
xxd-debuginfoamzn 20232:9.2.597-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-39881 Vim Ex command injection in Vims NetBeans integration7.8 0.0064 None reported
High CVE-2026-46483 Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag7.3 0.0055 None reported
High CVE-2026-52859 Vim: Out-of-bounds Read in Terminal Screen Snapshot8.8 0.0030 None reported
High CVE-2026-47162 Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name8.8 0.0028 None reported
High CVE-2026-52860 Vim: Arbitrary Code Execution via Python Omni-Completion7.8 0.0022 None reported
High CVE-2026-52858 Vim: Arbitrary Code Execution via Python Omni-Completion7.8 0.0020 None reported
High CVE-2026-43961 vim: A flaw was found in Vim's netrw plugin7.8 0.0016 None reported
High CVE-2026-47167 Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex7.3 0.0014 None reported
High CVE-2026-35177 Path traversal issue with zip.vim in Vim7.1 0.0013 None reported
Routine CVE-2026-44656 Vim: OS Command Injection via 'path' completion5.3 0.0092 None reported
Routine CVE-2026-42307 vim: Vim is an open source, command line text editor4.4 0.0077 None reported
Routine CVE-2026-45130 Vim: Heap Buffer Overflow in spell file loading6.6 0.0025 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.