Critical Code Execution Vulnerabilities in Vim Affecting Multiple Ubuntu Releases

Two critical vulnerabilities were discovered in Vim, affecting multiple versions of Ubuntu, including LTS releases from 14.04 to 26.04. The vulnerabilities, identified as CVE-2026-43961 and CVE-2026-46483, allow attackers to execute arbitrary code through marked filenames and improperly handled filenames in archives. Users are urged to update their systems to mitigate these risks. The vulnerabilities were published on May 15, 2026, and are currently being addressed through standard system updates. The affected versions include vim 2:9.1.2141-1ubuntu4.3 for Ubuntu 26.04 LTS and earlier versions down to 14.04 LTS. The issue poses a significant risk to users who have not yet applied the necessary updates.

Key Points: • Two critical vulnerabilities in Vim allow arbitrary code execution. • Affected Ubuntu versions range from 14.04 LTS to 26.04 LTS. • Users are advised to update their systems to mitigate risks.