Backport upstream commit a80874d9b84a to fix CVE-2026-55693,
an out-of-bounds write in tree_count_words() triggered by
crafted spell files. The patch adds depth bounds checks to
tree_count_words() and sug_filltree() in src/spellfile.c,
preventing writes past the MAXWLEN-sized depth arrays. A
test case is included. The mkdir 'R' flag was adapted for
Vim 8.2 compatibility.
CVE: CVE-2026-55693
Upstream patches:
- a80874d9b8.patch
Resolves: RHEL-194065
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 497f931f to fix CVE-2026-57455, an
out-of-bounds write in spell_soundfold_sofo(). The fix adds
a bounds check (ri < MAXWLEN - 1) to the copy loop so that
input longer than MAXWLEN cannot overflow the stack buffer.
The test was adapted for Vim 8.2 compatibility by replacing
defer/writefile 'D' flag with explicit call delete() at
function end.
CVE: CVE-2026-57455
Upstream patches:
- 497f931f85.patch
Resolves: RHEL-191362
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream patch 9.2.0736 (commit 43afc581) to fix
CVE-2026-59856 — potential arbitrary command execution via
crafted class names in PHP omni-completion.
The fix modifies runtime/autoload/phpcomplete.vim to properly
escape the class name with string() before inserting it into
the search() pattern run via win_execute(). Includes new test
file test_plugin_phpcomplete.vim with regression tests. The
Make_all.mak hunk was adapted for Vim 8.2's test list layout.
CVE: CVE-2026-59856
Upstream patches:
- 43afc581a3.patch
Resolves: RHEL-201196
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream patch fixing CVE-2026-59858, where a
crafted tags file could execute arbitrary Ex commands during
C omni-completion (struct/union member completion via
ccomplete.vim).
Patch 1 (upstream 6b611b0d) escapes the typeref field with
escape(typename, '/\') before interpolating it into the
:vimgrep pattern.
Patch is adapted to the legacy Vimscript style used
in the RHEL 8.2 codebase. A new test file
test_plugin_ccomplete.vim is added covering both injection
vectors and normal typeref completion.
CVE: CVE-2026-59858
Upstream patches:
- 6b611b0d15.patch
Resolves: RHEL-203984
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
