CVE-2026-59856

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.(CVE-2026-59856)

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.(CVE-2026-59857)

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.(CVE-2026-59858)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

• CVE-2026-59858: escape the typeref field with escape(typename, '/') before interpolating it into the :vimgrep pattern in ccomplete.vim StructMembers(), preventing arbitrary Ex command execution during C omni-completion when reading a crafted tags file (runtime/autoload/ccomplete.vim, upstream vim 9.2.0735)
• CVE-2026-59856: quote the class name via string() before interpolating it into the search() pattern executed by win_execute() in phpcomplete.vim GetClassContentsStructure(), preventing potential command execution during PHP omni-completion (runtime/autoload/phpcomplete.vim, upstream vim 9.2.0736)

• CVE-2026-59858: escape the typeref field with escape(typename, '/') before interpolating it into the :vimgrep pattern in ccomplete.vim StructMembers(), preventing arbitrary Ex command execution during C omni-completion when reading a crafted tags file (runtime/autoload/ccomplete.vim, upstream vim 9.2.0735)
• CVE-2026-59856: quote the class name via string() before interpolating it into the search() pattern executed by win_execute() in phpcomplete.vim GetClassContentsStructure(), preventing potential command execution during PHP omni-completion (runtime/autoload/phpcomplete.vim, upstream vim 9.2.0736)

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

Root has patched CVE-2026-59856 in the vim package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-59856 in the vim package for Root:Debian:12. Multiple fixed versions available.

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

This update for vim fixes the following issues

• Updated to version 9.2.0780
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

This update for vim fixes the following issues

• Updated to version 9.2.0780
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues

• Updated to version 9.2.0780.
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues

• Updated to version 9.2.0780.
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues:

This update for vim fixes the following issues:

Security issues fixed:

• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

Non security issue fixed:

• Guard suse.vimrc against re-entry to prevent an infinite sourcing loop (bsc#1271684).
• allow 'wrap' and 'linebreak' to be set from a modeline (bsc#1268162).

Changes for vim:

• Updated to version 9.2.0780:

• filetype detect missing from completion (9.2.0726).
• popup images not rendered correctly when unfocused (9.2.0727).
• filetype: supertux info pattern is relative to current dir (9.2.0728).
• % skips parens on continued quoted lines (9.2.0729).
• GTK4 GUI tabline is not updated (9.2.0730).
• GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
• session: terminal restored using absolute columns/rows (9.2.0732).
• GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
• function pointer passed to STRNCMP() instead of a length (9.2.0734).
• tests: comment test can be improved (9.2.0737).
• completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
• GTK4: scrollbar wrongly displayed (9.2.0740).
• complete_check() does not return TRUE for mapped input (9.2.0741).
• filetype: SSH keys and related filetypes not recognized (9.2.0742).
• string macros silently accept a size of the wrong type (9.2.0743).
• popup_atcursor() closes immediately on white space (9.2.0744).
• cscope: connection leak when growing the array fails (9.2.0747).
• 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
• 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
• completion: 'autocompletedelay' deferral leaks state (9.2.0750).
• GTK3 GUI is slow under Wayland (9.2.0751).
• GTK4: drag-and-drop does not support HTML (9.2.0752).
• GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
• repeated completion length lookup in search_for_exact_line (9.2.0754).
• 'autocomplete' behaves inconsistently when recording (9.2.0755).
• session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
• pum: no opacity when background not set for Popup menu group (9.2.0758).
• some code for 'autocompletedelay' is no longer needed (9.2.0759).
• compiler warning for using potentially uninitialized var (9.2.0760).
• runtime(netrw): Unix: unable to open '' file (9.2.0761).
• duplicated sub-option name check in :set completion (9.2.0762).
• compiler warning about unused function (9.2.0764).
• popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
• quick_tab entries for empty letters point to the wrong index (9.2.0766).
• legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
• legacy/vim9cmd modifiers are not exclusive (9.2.0768).
• conversion to utf-16be using iconv is inconsistent (9.2.0769).
• dict_add_dict() has inconsistent ownership on failure (9.2.0770).
• dict_add_list() has inconsistent ownership on failure (9.2.0771).
• Vim9: null dereference inside alloc_type() (9.2.0772).
• memory leak in evalfunc.c on alloc failure (9.2.0773).
• memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
• memory leak in highlight_get_info() on alloc failure (9.2.0775).
• memory leak in sign_getlist() on alloc failure (9.2.0776).
• memory leak in add_defer() on alloc failure (9.2.0777).
• memory leak in compile_dict() on alloc failure (9.2.0778).
• memory leak in type_name_func() on alloc failure (9.2.0779).
• memory leak in evalvars.c on alloc failure (9.2.0780).

• Updated to version 9.2.0725:

• GTK: preedit font size is wrong for fractional point sizes (9.2.0532).
• '[ mark moved to end of inserted text after CTRL-R CTRL-P paste (9.2.0533).
• GTK UI does not support fullscreen mode (9.2.0534). *…

Hirohito Higashi discovered that Vim incorrectly escaped class or trait names when performing PHP omni-completion. An attacker could possibly use this issue to trick a user into opening a specially crafted PHP file and executing arbitrary commands. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-59856)

Hirohito Higashi discovered that Vim incorrectly handled sound-folding of certain words when using a spell file. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service. (CVE-2026-59857)

It was discovered that Vim incorrectly escaped certain tags file fields when performing C omni-completion. An attacker could possibly use this issue to trick a user into opening a specially crafted file and executing arbitrary commands. (CVE-2026-59858)