diff --git a/0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch b/0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch
new file mode 100644
index 00000000..4a3b0ae1
--- /dev/null
+++ b/0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch
@@ -0,0 +1,79 @@
+From 952ef64dbdc6939d8beb59ce1304f231debc52e2 Mon Sep 17 00:00:00 2001
+From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
+Date: Thu, 30 Jul 2026 12:30:41 +0000
+Subject: [PATCH] patch 9.2.0495: [security]: runtime(netrw): code injection
+ via NetrwBookHistSave()
+
+Problem:  [security]: runtime(netrw): code injection via
+          NetrwBookHistSave()
+Solution: Properly quote the directory name using string() function
+          (Srinivas Piskala Ganesh Babu)
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c
+---
+ runtime/autoload/netrw.vim        |  2 +-
+ src/testdir/Make_all.mak          |  2 ++
+ src/testdir/test_plugin_netrw.vim | 20 ++++++++++++++++++++
+ 3 files changed, 23 insertions(+), 1 deletion(-)
+ create mode 100644 src/testdir/test_plugin_netrw.vim
+
+diff --git a/runtime/autoload/netrw.vim b/runtime/autoload/netrw.vim
+index 5fd08ac..41893e2 100644
+--- a/runtime/autoload/netrw.vim
++++ b/runtime/autoload/netrw.vim
+@@ -3736,7 +3736,7 @@ fun! s:NetrwBookHistSave()
+    while ( first || cnt != g:netrw_dirhistcnt )
+     let lastline= lastline + 1
+     if exists("g:netrw_dirhist_{cnt}")
+-     call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'")
++     call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt}))
+ "     call Decho("..".lastline.'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'",'~'.expand("<slnum>"))
+     endif
+     let first   = 0
+diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
+index 7fd4e89..1709886 100644
+--- a/src/testdir/Make_all.mak
++++ b/src/testdir/Make_all.mak
+@@ -209,6 +209,7 @@ NEW_TESTS = \
+ 	test_perl \
+ 	test_plugin_ccomplete \
++	test_plugin_netrw \
+ 	test_plugin_tar \
+ 	test_plugin_phpcomplete \
+ 	test_plugin_python3complete \
+ 	test_plus_arg_edit \
+@@ -448,6 +449,7 @@ NEW_TESTS_RES = \
+ 	test_perl.res \
+ 	test_plugin_ccomplete.res \
++	test_plugin_netrw.res \
+ 	test_plugin_tar.res \
+ 	test_plugin_phpcomplete.res \
+ 	test_plugin_python3complete.res \
+ 	test_plus_arg_edit.res \
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+new file mode 100644
+index 0000000..d840905
+--- /dev/null
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -0,0 +1,20 @@
++func Test_netrw_injection()
++  let g:netrw_home       = getcwd()
++  let savefile           = g:netrw_home . '/.netrwhist'
++  let g:netrw_dirhistmax = 10
++  let g:netrw_dirhistcnt = 1
++  let g:netrw_dirhist_1  = "x'|let g:injected = 1|let y='z"
++  call delete(savefile)
++  try
++    call netrw#Call('NetrwBookHistSave')
++    call assert_true(filereadable(savefile), savefile . ' must be written')
++    unlet g:netrw_dirhist_1
++    execute 'source ' . fnameescape(savefile)
++    call assert_false(exists("g:injected"), 'injected statement must not execute')
++    call assert_equal("x'|let g:injected = 1|let y='z", g:netrw_dirhist_1, 'dirname must round-trip')
++  finally
++    call delete(savefile)
++    unlet! g:netrw_home g:netrw_dirhistmax g:netrw_dirhistcnt g:netrw_dirhist_1 g:injected
++  endtry
++endfunc
++" vim:ts=8 sts=2 sw=2 et
diff --git a/vim.spec b/vim.spec
index 09c2870c..9368ec6b 100644
--- a/vim.spec
+++ b/vim.spec
@@ -27,7 +27,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 38%{?dist}
+Release: 39%{?dist}
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: virc
@@ -233,6 +233,11 @@ Patch3077: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch
 # adapted test for Vim 8.2 (added source check.vim, replaced defer with manual cleanup),
 # kept self.params instead of upstream safe_params (prior hardening commit not present)
 Patch3078: 0001-patch-9.2.0699-security-possible-code-execution-with.patch
+# RHEL-186655 CVE-2026-47162 runtime(netrw): code injection via NetrwBookHistSave()
+# https://redhat.atlassian.net/browse/RHEL-186655
+# https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b
+# adjusted: netrw path changed from runtime/pack/dist/opt/netrw/autoload/ to runtime/autoload/ (Vim 8.2)
+Patch3079: 0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch
 
 
 # gcc is no longer in buildroot by default
@@ -499,6 +504,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3076 -p1 -b .soundfold-overflow
 %patch -P 3077 -p1 -b .tree-count-words-oob
 %patch -P 3078 -p1 -b .python-complete-repr
+%patch -P 3079 -p1 -b .netrw-book-hist-inject
 
 %build
 cd src
@@ -1051,6 +1057,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %endif
 
 %changelog
+* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-39
+- RHEL-186655 CVE-2026-47162 vim: netrw code injection via
+  NetrwBookHistSave()
+
 * Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-38
 - RHEL-192114 CVE-2026-57456 vim: possible code execution with python
   complete