diff --git a/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
new file mode 100644
index 00000000..cd74a194
--- /dev/null
+++ b/0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
@@ -0,0 +1,67 @@
+From 71827f5d2af8cee6aa1b7e9868e28d84e2008e96 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 21 Jun 2026 19:20:03 +0000
+Subject: [PATCH] patch 9.2.0698: [security]: Out-of-bounds write with
+ soundfold()
+
+Problem:  [security]: Out-of-bounds write with soundfold()
+          (cipher-creator)
+Solution: Add an abort condition to the for loop to validate the buffer
+          size.
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+---
+ src/spell.c                    |  2 +-
+ src/testdir/test_spellfile.vim | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index d43056660..52117ea71 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -3167,7 +3167,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res)
+     else
+     {
+ 	// The sl_sal_first[] table contains the translation.
+-	for (s = inword; (c = *s) != NUL; ++s)
++	for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s)
+ 	{
+ 	    if (VIM_ISWHITE(c))
+ 		c = ' ';
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 410553daf..a400d51c0 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -874,4 +874,27 @@ func Test_mkspellmem_opt()
+   call assert_fails('set mkspellmem=1000,50,0', 'E474:')
+ endfunc
+ 
++" A word longer than MAXWLEN must not overflow the soundfold result buffer in
++" the single-byte SOFO branch of spell_soundfold_sofo().
++func Test_soundfold_overflow()
++  let _enc=&enc
++  set enc=latin1
++  call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff')
++  call writefile(['1', 'foo'], 'Xtest.dic')
++  mkspell! Xtest Xtest
++  setl spelllang=Xtest.latin1.spl spell
++
++  " Before the fix the copy loop wrote one byte per input byte into a
++  " MAXWLEN (254) stack buffer with no upper bound, smashing the stack.
++  let sound = soundfold(repeat('ab', 300))
++  call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN')
++
++  set spell& spelllang&
++  let &enc = _enc
++  call delete('Xtest.aff')
++  call delete('Xtest.dic')
++  call delete('Xtest.latin1.spl')
++  call delete('Xtest.latin1.sug')
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
diff --git a/vim.spec b/vim.spec
index 517ab02f..ae5a8ab5 100644
--- a/vim.spec
+++ b/vim.spec
@@ -27,7 +27,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 35%{?dist}
+Release: 36%{?dist}
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: virc
@@ -216,6 +216,11 @@ Patch3074: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch
 # https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24
 # adjusted: adapted Make_all.mak hunk for Vim 8.2 test list, stripped src/version.c
 Patch3075: 0001-patch-9.2.0736-potential-command-execution-in-PHP-omn.patch
+# RHEL-191362 CVE-2026-57455 Out-of-bounds write with soundfold()
+# https://redhat.atlassian.net/browse/RHEL-191362
+# https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b
+# adjusted: replaced defer/writefile 'D' flag with call delete() for Vim 8.2 compat
+Patch3076: 0001-patch-9.2.0698-security-Out-of-bounds-write-with-sou.patch
 
 
 # gcc is no longer in buildroot by default
@@ -479,6 +484,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch -P 3073 -p1 -b .cucumber-code-inject
 %patch -P 3074 -p1 -b .ccomplete-typeref-escape
 %patch -P 3075 -p1 -b .phpcomplete-cmd-exec
+%patch -P 3076 -p1 -b .soundfold-overflow
 
 %build
 cd src
@@ -1031,6 +1037,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %endif
 
 %changelog
+* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-36
+- RHEL-191362 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
+
 * Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-35
 - RHEL-201196 CVE-2026-59856 vim: potential command execution in PHP
   omni-completion