CVE-2026-59858

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.(CVE-2026-59856)

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.(CVE-2026-59857)

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.(CVE-2026-59858)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
• vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
• vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
• vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
• vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-59858: escape the typeref field with escape(typename, '/') before interpolating it into the :vimgrep pattern in ccomplete.vim StructMembers(), preventing arbitrary Ex command execution during C omni-completion when reading a crafted tags file (runtime/autoload/ccomplete.vim, upstream vim 9.2.0735)
• CVE-2026-59856: quote the class name via string() before interpolating it into the search() pattern executed by win_execute() in phpcomplete.vim GetClassContentsStructure(), preventing potential command execution during PHP omni-completion (runtime/autoload/phpcomplete.vim, upstream vim 9.2.0736)

• CVE-2026-59858: escape the typeref field with escape(typename, '/') before interpolating it into the :vimgrep pattern in ccomplete.vim StructMembers(), preventing arbitrary Ex command execution during C omni-completion when reading a crafted tags file (runtime/autoload/ccomplete.vim, upstream vim 9.2.0735)
• CVE-2026-59856: quote the class name via string() before interpolating it into the search() pattern executed by win_execute() in phpcomplete.vim GetClassContentsStructure(), preventing potential command execution during PHP omni-completion (runtime/autoload/phpcomplete.vim, upstream vim 9.2.0736)

• SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: the typeref/typename tag field is interpolated unescaped into the :vimgrep pattern in s:StructMembers() in runtime/autoload/ccomplete.vim, so a crafted tags file can close the search pattern and append an arbitrary Ex command when completing a struct/union member
  • debian/patches/CVE-2026-59858.patch: wrap the type field with escape(typename, '/') before inserting it into the :vimgrep pattern in s:StructMembers() so it can no longer close the search pattern and start a new Ex command
  • CVE-2026-59858

• CVE-2026-59858: fix arbitrary Ex command execution in C omni-completion by escaping the typeref/typename tag field before inserting it into the :vimgrep pattern in ccomplete.vim (upstream 9.2.0735)

• CVE-2026-59858: fix arbitrary Ex command execution in C omni-completion by escaping the typeref/typename tag field before inserting it into the :vimgrep pattern in ccomplete.vim (upstream 9.2.0735)

• CVE-2026-59858: fix arbitrary Ex command execution during C omni-completion; the typeref/typename tag field was interpolated unescaped into a :vimgrep pattern run via :execute, letting a crafted tags file close the pattern and append an Ex command; escape the type field with escape(typename, '/') (runtime/autoload/ccomplete.vim, upstream patch 9.2.0735)

• CVE-2026-59858: fix arbitrary Ex command execution during C omni-completion; the typeref/typename tag field was interpolated unescaped into a :vimgrep pattern run via :execute, letting a crafted tags file close the pattern and append an Ex command; escape the type field with escape(typename, '/') (runtime/autoload/ccomplete.vim, upstream patch 9.2.0735)

• SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: the C omni-completion script interpolated the typeref/typename tag field of a tags entry, without escaping, into a :vimgrep pattern run through :execute. Because :vimgrep honours the bar as a command separator, a crafted tag field could close the search pattern and append an arbitrary Ex command, which ran when C omni-completion was invoked on a hostile .c file whose project tags file carried such an entry.
  • debian/patches/CVE-2026-59858.patch: escape the type field with escape(typename, '/') before building the :vimgrep pattern in s:StructMembers(), in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0735.
  • CVE-2026-59858

• CVE-2026-59858: fix arbitrary Ex command execution during C omni-completion; the typeref/typename tag field was interpolated unescaped into a :vimgrep pattern run via :execute, letting a crafted tags file close the pattern and append an Ex command; escape the type field with escape(typename, '/') (runtime/autoload/ccomplete.vim, upstream patch 9.2.0735)

• CVE-2026-59858: escape the typeref/typename tags field before interpolating it into the :vimgrep pattern in ccomplete.vim s:StructMembers(), preventing arbitrary Ex command execution during C omni-completion (upstream 9.2.0735)

• CVE-2026-59858: escape the typeref/typename tags field before interpolating it into the :vimgrep pattern in ccomplete.vim s:StructMembers(), preventing arbitrary Ex command execution during C omni-completion (upstream 9.2.0735)

• SECURITY UPDATE: command injection in the tar plugin: tar#Vimuntar() escaped the tarball name with shellescape() without the special argument before running gunzip/gzip through :!, so characters that Vim expands in a :! command line (such as % and #) survived in the name and let a crafted archive name run arbitrary shell commands.
  • debian/patches/CVE-2026-46483.patch: use the shellescape(name, 1) form for both :! invocations in runtime/autoload/tar.vim; matches upstream patch 9.2.0479.
  • CVE-2026-46483
• SECURITY UPDATE: code injection via netrw directory history: s:NetrwBookHistSave() serialised each history entry into ~/.vim/.netrwhist by wrapping the value in single quotes with string concatenation, so a directory name containing a single quote closed the literal and injected Vimscript that ran when the history file was sourced on the next netrw start.
  • debian/patches/CVE-2026-47162.patch: encode the value with string() in runtime/autoload/netrw.vim; matches upstream patch 9.2.0495.
  • CVE-2026-47162
• SECURITY UPDATE: code execution through Python omni-completion: pythoncomplete and python3complete rebuilt the buffer's Python code and passed it to exec(), including the import and from statements harvested from the buffer, so invoking omni-completion in a hostile Python file executed arbitrary module-level code.
  • debian/patches/CVE-2026-52858.patch: skip import/from statements unless g:pythoncomplete_allow_import is set, in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patches 9.2.0561 and 9.2.0568, the latter being required for the opt-in to take effect at all.
  • CVE-2026-52858
• SECURITY UPDATE: out-of-bounds access when a terminal buffer is snapshotted: the per-cell loop in move_terminal_to_buffer() walked cell.chars[] with no upper bound, and libvterm leaves that array unterminated when a cell uses all VTERM_MAX_CHARS_PER_CELL slots (a base character plus five combining marks), so it read past the array and appended the out-of-bounds values to a buffer sized for far fewer bytes.
  • debian/patches/CVE-2026-52859.patch: bound the loop with i < VTERM_MAX_CHARS_PER_CELL and size the buffer for six 6-byte characters, in src/terminal.c; matches upstream patch 9.2.0565 together with its prerequisite 8.1.0611, without which the bounded loop would still overrun the MB_MAXBYTES-sized buffer.
  • CVE-2026-52859
• SECURITY UPDATE: code execution through Python omni-completion definition headers: Scope.get_code() reproduced def and class headers verbatim in the source handed to exec(), and Python evaluates parameter default values, annotations and base-class expressions at definition time, so crafted headers ran arbitrary code during completion even with imports disabled.
  • debian/patches/CVE-2026-52860.patch: strip default values and annotations from parameters and accept only dotted names as base classes, in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patch 9.2.0597.
  • CVE-2026-52860
• SECURITY UPDATE: out-of-bounds write reading a crafted spell file: tree_count_words() and sug_filltree() descended the word trie without bounding the depth, so a deeply nested trie wrote past the ends of their MAXWLEN-sized arridx[], curi[] and wordcount[] arrays.
  • debian/patches/CVE-2026-55693.patch: only descend while depth < MAXWLEN - 1 in both trie walkers, in src/spellfile.c; matches upstream patch 9.2.0653.
  • CVE-2026-55693
• SECURITY UPDATE: code injection when netrw opens a remote file: s:NetrwBrowse() passed bufname() unescaped into an :execute'd "b" command, so a buffer name containing the Ex command separator ran arbitrary…

• SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: s:StructMembers() in runtime/autoload/ccomplete.vim interpolates a tags-file typeref/typename value into a :vimgrep pattern with only "/" and "" escaped, so an unclosed "[" makes vimgrep pattern skipping fail and a following "|" is then parsed as an Ex command separator, running the rest of the tag value as Ex commands
  • debian/patches/CVE-2026-73073.patch: match the typename literally in s:StructMembers() by prefixing it with "\V" and restoring magic mode with "\m" for the trailing "(\t|$)" group, so no regex metacharacter in the tag field can affect :vimgrep pattern parsing; this completes CVE-2026-59858.patch (upstream 9.2.0735), whose escaping alone was insufficient; the upstream src/version.c bump and the new src/testdir/test_plugin_ccomplete.vim test are omitted as they do not apply to 8.1.0875
  • CVE-2026-73073

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

Root has patched CVE-2026-59858 in the vim package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-59858 in the vim package for Root:Debian:12. Multiple fixed versions available.

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

This update for vim fixes the following issues

• Updated to version 9.2.0780
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues:

Update to version 9.2.0780.

Security issues fixed:

• CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
• CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
• CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

Other updates and bugfixes:

• Version 9.2.0780 changelog:
  • filetype detect missing from completion (9.2.0726).
  • popup images not rendered correctly when unfocused (9.2.0727).
  • filetype: supertux info pattern is relative to current dir (9.2.0728).
  • % skips parens on continued quoted lines (9.2.0729).
  • GTK4 GUI tabline is not updated (9.2.0730).
  • GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
  • session: terminal restored using absolute columns/rows (9.2.0732).
  • GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
  • function pointer passed to STRNCMP() instead of a length (9.2.0734).
  • tests: comment test can be improved (9.2.0737).
  • completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
  • GTK4: scrollbar wrongly displayed (9.2.0740).
  • complete_check() does not return TRUE for mapped input (9.2.0741).
  • filetype: SSH keys and related filetypes not recognized (9.2.0742).
  • string macros silently accept a size of the wrong type (9.2.0743).
  • popup_atcursor() closes immediately on white space (9.2.0744).
  • cscope: connection leak when growing the array fails (9.2.0747).
  • 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
  • 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
  • completion: 'autocompletedelay' deferral leaks state (9.2.0750).
  • GTK3 GUI is slow under Wayland (9.2.0751).
  • GTK4: drag-and-drop does not support HTML (9.2.0752).
  • GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
  • repeated completion length lookup in search_for_exact_line (9.2.0754).
  • 'autocomplete' behaves inconsistently when recording (9.2.0755).
  • session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
  • tests: test_popupwin fails with zsh because of the prompt (9.2.0757).
  • pum: no opacity when background not set for Popup menu group (9.2.0758).
  • some code for 'autocompletedelay' is no longer needed (9.2.0759).
  • compiler warning for using potentially uninitialized var (9.2.0760).
  • runtime(netrw): Unix: unable to open '' file (9.2.0761).
  • duplicated sub-option name check in :set completion (9.2.0762).
  • tests: style issue in test_plugin_netrw (9.2.0763).
  • compiler warning about unused function (9.2.0764).
  • popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
  • quick_tab entries for empty letters point to the wrong index (9.2.0766).
  • legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
  • legacy/vim9cmd modifiers are not exclusive (9.2.0768).
  • conversion to utf-16be using iconv is inconsistent (9.2.0769).
  • dict_add_dict() has inconsistent ownership on failure (9.2.0770).
  • dict_add_list() has inconsistent ownership on failure (9.2.0771).
  • Vim9: null dereference inside alloc_type() (9.2.0772).
  • memory leak in evalfunc.c on alloc failure (9.2.0773).
  • memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
  • memory leak in highlight_get_info() on alloc failure (9.2.0775).
  • memory leak in sign_getlist() on alloc failure (9.2.0776).
  • memory leak in add_defer() on alloc failure (9.2.0777).
  • memory leak in compile_dict() on alloc failure (9.2.0778).
  • memory leak in type_name_func() on alloc failure (9.2.0779).
  • memory leak in evalvars.c on alloc failure (9.2.0780).

This update for vim fixes the following issues

• Updated to version 9.2.0780
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues

• Updated to version 9.2.0780.
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues

• Updated to version 9.2.0780.
• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

This update for vim fixes the following issues:

This update for vim fixes the following issues:

Security issues fixed:

• CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
• CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
• CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

Non security issue fixed:

• Guard suse.vimrc against re-entry to prevent an infinite sourcing loop (bsc#1271684).
• allow 'wrap' and 'linebreak' to be set from a modeline (bsc#1268162).

Changes for vim:

• Updated to version 9.2.0780:

• filetype detect missing from completion (9.2.0726).
• popup images not rendered correctly when unfocused (9.2.0727).
• filetype: supertux info pattern is relative to current dir (9.2.0728).
• % skips parens on continued quoted lines (9.2.0729).
• GTK4 GUI tabline is not updated (9.2.0730).
• GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731).
• session: terminal restored using absolute columns/rows (9.2.0732).
• GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
• function pointer passed to STRNCMP() instead of a length (9.2.0734).
• tests: comment test can be improved (9.2.0737).
• completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739).
• GTK4: scrollbar wrongly displayed (9.2.0740).
• complete_check() does not return TRUE for mapped input (9.2.0741).
• filetype: SSH keys and related filetypes not recognized (9.2.0742).
• string macros silently accept a size of the wrong type (9.2.0743).
• popup_atcursor() closes immediately on white space (9.2.0744).
• cscope: connection leak when growing the array fails (9.2.0747).
• 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
• 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
• completion: 'autocompletedelay' deferral leaks state (9.2.0750).
• GTK3 GUI is slow under Wayland (9.2.0751).
• GTK4: drag-and-drop does not support HTML (9.2.0752).
• GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
• repeated completion length lookup in search_for_exact_line (9.2.0754).
• 'autocomplete' behaves inconsistently when recording (9.2.0755).
• session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
• pum: no opacity when background not set for Popup menu group (9.2.0758).
• some code for 'autocompletedelay' is no longer needed (9.2.0759).
• compiler warning for using potentially uninitialized var (9.2.0760).
• runtime(netrw): Unix: unable to open '' file (9.2.0761).
• duplicated sub-option name check in :set completion (9.2.0762).
• compiler warning about unused function (9.2.0764).
• popup: opacity popup over a terminal is not cleared when moved (9.2.0765).
• quick_tab entries for empty letters point to the wrong index (9.2.0766).
• legacy/vim9cmd modifiers do not set script version for options values (9.2.0767).
• legacy/vim9cmd modifiers are not exclusive (9.2.0768).
• conversion to utf-16be using iconv is inconsistent (9.2.0769).
• dict_add_dict() has inconsistent ownership on failure (9.2.0770).
• dict_add_list() has inconsistent ownership on failure (9.2.0771).
• Vim9: null dereference inside alloc_type() (9.2.0772).
• memory leak in evalfunc.c on alloc failure (9.2.0773).
• memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
• memory leak in highlight_get_info() on alloc failure (9.2.0775).
• memory leak in sign_getlist() on alloc failure (9.2.0776).
• memory leak in add_defer() on alloc failure (9.2.0777).
• memory leak in compile_dict() on alloc failure (9.2.0778).
• memory leak in type_name_func() on alloc failure (9.2.0779).
• memory leak in evalvars.c on alloc failure (9.2.0780).

• Updated to version 9.2.0725:

• GTK: preedit font size is wrong for fractional point sizes (9.2.0532).
• '[ mark moved to end of inserted text after CTRL-R CTRL-P paste (9.2.0533).
• GTK UI does not support fullscreen mode (9.2.0534). *…

Hirohito Higashi discovered that Vim incorrectly escaped class or trait names when performing PHP omni-completion. An attacker could possibly use this issue to trick a user into opening a specially crafted PHP file and executing arbitrary commands. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-59856)

Hirohito Higashi discovered that Vim incorrectly handled sound-folding of certain words when using a spell file. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service. (CVE-2026-59857)

It was discovered that Vim incorrectly escaped certain tags file fields when performing C omni-completion. An attacker could possibly use this issue to trick a user into opening a specially crafted file and executing arbitrary commands. (CVE-2026-59858)