Backport upstream patch 9.2.0653 (commit a80874d9) to fix
CVE-2026-55693 — an out-of-bounds write in tree_count_words()
in src/spellfile.c. A crafted spell file could drive the
function past its MAXWLEN-sized depth arrays. The fix adds
depth bound checks in tree_count_words() and sug_filltree(),
along with a new test case in test_spellfile.vim.
CVE: CVE-2026-55693
Upstream patches:
- a80874d9b8.patch
Resolves: RHEL-194056
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-59858 from commit
6b611b0d15603c52ebdad17172b0232b4f65704e. A crafted tags
file could execute arbitrary Ex commands when completing
struct/union members via C omni-completion. The fix escapes
the typename field before interpolating it into the :vimgrep
pattern in StructMembers(), preventing command injection.
A new test file validates both the security fix and that
normal struct-member completion continues to work.
CVE: CVE-2026-59858
Upstream patches:
- 6b611b0d15.patch
- d9ec676911
Resolves: RHEL-203886
Backport upstream commit 497f931f to fix CVE-2026-57455,
a stack buffer overflow in spell_soundfold_sofo(). The fix
adds a bounds check (ri < MAXWLEN - 1) to the loop condition
to prevent writing past the end of the result buffer. A
corresponding test case is included in the patch.
CVE: CVE-2026-57455
Upstream patches:
- 497f931f85.patch
Resolves: RHEL-191361
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 43afc581a37a to fix CVE-2026-59856,
a potential arbitrary command execution vulnerability in the
PHP omni-completion plugin. The fix uses string() for safe
quoting of the class name before inserting it into the
search() pattern run via win_execute() in phpcomplete.vim,
preventing command injection via crafted PHP files. A new
test file (test_plugin_phpcomplete.vim) verifies the fix.
CVE: CVE-2026-59856
Upstream patches:
- 43afc581a3.patch
Resolves: RHEL-201124
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
