CVE-2026-73070

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839. (CVE-2026-73077) Arbitrary Code Execution via Netrw Menu Construction in Vim < 9.2.0840. (CVE-2026-73078) Heap Buffer Overflow in Text Property Handling in Vim < 9.2.0841. (CVE-2026-73074) Stack Buffer Overflow in the Vim Socket Server in Vim < 9.2.0842. (CVE-2026-73070) Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843. (CVE-2026-73075) Use-after-free in JSON Decoding in Vim >= 9.2.0511 && Vim < 9.2.0844. (CVE-2026-73071) Arbitrary Ex Command Execution in C Omni-Completion in Vim < 9.2.0845. (CVE-2026-73073) Heap Buffer Overflow when Loading a Spell File in Vim < 9.2.0846. (CVE-2026-73072) Arbitrary Command Execution via Malicious .VimballRecord Entry Replay in vimball.vim. (CVE-2026-73076)

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

• Version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp:…

This update for vim fixes the following issues:

Updated to version 9.2.0957.

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

• Version 9.2.0957:
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp: submatch in a look-behind is empty…

This update for vim fixes the following issues:

Updated to version 9.2.0957.

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

• Version 9.2.0957:
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp: submatch in a look-behind is empty…

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

• Version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp:…

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

• Version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp:…

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

• Version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp:…

This update for vim fixes the following issues:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

• Updated to version 9.2.0957.

• tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
• tests: missing cleanup in test_mksession.vim (9.2.0782).
• tests: personal spell files leak into later tests (9.2.0783).
• crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
• WinResized not triggered when the whole Vim is resized (9.2.0785).
• filetype: containerfile is not recognized (9.2.0786).
• regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
• filetype: hip files are not recognized (9.2.0788).
• 'statuslineopt' status line too high after a window is minimized (9.2.0789).
• 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
• wincol() counts from right side for 'rightleft' (9.2.0791).
• runtime(netrw): explore without optional dir broken (9.2.0792).
• if session restored a tiny window, restore fails (9.2.0793).
• extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
• popup menu shadow is not cleared when the menu shrinks (9.2.0795).
• Visual block reselection wrong with 'virtualedit' (9.2.0796).
• memory leak in get_qfline_items() on alloc failure (9.2.0797).
• memory leak in compile_expr6() on alloc failure (9.2.0798).
• memory leak in compile_def_function_body() on alloc failure (9.2.0799).
• memory leak in call_func() on alloc failure (9.2.0800).
• memory leak in f_getreginfo() on alloc failure (9.2.0801).
• memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
• memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
• wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
• screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
• 'showcmd' may show internal command keys (9.2.0806).
• MS-Windows: ellipsis character is garbled (9.2.0807).
• getregionpos: double-free on alloc failure (9.2.0808).
• getframelayout() uses wrong function to free lists (9.2.0809).
• add_llist_tags() uses wrong function to free dict (9.2.0810).
• mksession writes terminal command unquoted (9.2.0811).
• :argdelete with pattern leads to wrong argidx() (9.2.0812).
• dict_add_func() may corrupt funcref count on failure (9.2.0813).
• Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
• deeply nested regexp patterns may cause stack overflow (9.2.0815).
• GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
• crash when building a stacktrace during an autocommand (9.2.0817).
• tests: client-server test fails without X11 server (9.2.0818).
• MS-Windows: sixel image shown as raw text in the console (9.2.0819).
• GUI: hidden popup image is displayed and not erased (9.2.0820).
• filetype: msmtp system-wide rc file not detected (9.2.0821).
• GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
• tests: Test_clientserver_servlist_list may fail (9.2.0823).
• Makefile: make tags depends on configure (9.2.0824).
• regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
• highlighting for broken…

This update for vim fixes the following issues:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

• Updated to version 9.2.0957.

• tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
• tests: missing cleanup in test_mksession.vim (9.2.0782).
• tests: personal spell files leak into later tests (9.2.0783).
• crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
• WinResized not triggered when the whole Vim is resized (9.2.0785).
• filetype: containerfile is not recognized (9.2.0786).
• regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
• filetype: hip files are not recognized (9.2.0788).
• 'statuslineopt' status line too high after a window is minimized (9.2.0789).
• 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
• wincol() counts from right side for 'rightleft' (9.2.0791).
• runtime(netrw): explore without optional dir broken (9.2.0792).
• if session restored a tiny window, restore fails (9.2.0793).
• extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
• popup menu shadow is not cleared when the menu shrinks (9.2.0795).
• Visual block reselection wrong with 'virtualedit' (9.2.0796).
• memory leak in get_qfline_items() on alloc failure (9.2.0797).
• memory leak in compile_expr6() on alloc failure (9.2.0798).
• memory leak in compile_def_function_body() on alloc failure (9.2.0799).
• memory leak in call_func() on alloc failure (9.2.0800).
• memory leak in f_getreginfo() on alloc failure (9.2.0801).
• memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
• memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
• wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
• screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
• 'showcmd' may show internal command keys (9.2.0806).
• MS-Windows: ellipsis character is garbled (9.2.0807).
• getregionpos: double-free on alloc failure (9.2.0808).
• getframelayout() uses wrong function to free lists (9.2.0809).
• add_llist_tags() uses wrong function to free dict (9.2.0810).
• mksession writes terminal command unquoted (9.2.0811).
• :argdelete with pattern leads to wrong argidx() (9.2.0812).
• dict_add_func() may corrupt funcref count on failure (9.2.0813).
• Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
• deeply nested regexp patterns may cause stack overflow (9.2.0815).
• GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
• crash when building a stacktrace during an autocommand (9.2.0817).
• tests: client-server test fails without X11 server (9.2.0818).
• MS-Windows: sixel image shown as raw text in the console (9.2.0819).
• GUI: hidden popup image is displayed and not erased (9.2.0820).
• filetype: msmtp system-wide rc file not detected (9.2.0821).
• GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
• tests: Test_clientserver_servlist_list may fail (9.2.0823).
• Makefile: make tags depends on configure (9.2.0824).
• regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
• highlighting for broken…

This update for vim fixes the following issues:

• CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
• CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
• CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
• CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
• CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
• CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
• CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
• CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

• Updated to version 9.2.0957.

• tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
• tests: missing cleanup in test_mksession.vim (9.2.0782).
• tests: personal spell files leak into later tests (9.2.0783).
• crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
• WinResized not triggered when the whole Vim is resized (9.2.0785).
• filetype: containerfile is not recognized (9.2.0786).
• regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
• filetype: hip files are not recognized (9.2.0788).
• 'statuslineopt' status line too high after a window is minimized (9.2.0789).
• 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
• wincol() counts from right side for 'rightleft' (9.2.0791).
• runtime(netrw): explore without optional dir broken (9.2.0792).
• if session restored a tiny window, restore fails (9.2.0793).
• extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
• popup menu shadow is not cleared when the menu shrinks (9.2.0795).
• Visual block reselection wrong with 'virtualedit' (9.2.0796).
• memory leak in get_qfline_items() on alloc failure (9.2.0797).
• memory leak in compile_expr6() on alloc failure (9.2.0798).
• memory leak in compile_def_function_body() on alloc failure (9.2.0799).
• memory leak in call_func() on alloc failure (9.2.0800).
• memory leak in f_getreginfo() on alloc failure (9.2.0801).
• memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
• memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
• wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
• screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
• 'showcmd' may show internal command keys (9.2.0806).
• MS-Windows: ellipsis character is garbled (9.2.0807).
• getregionpos: double-free on alloc failure (9.2.0808).
• getframelayout() uses wrong function to free lists (9.2.0809).
• add_llist_tags() uses wrong function to free dict (9.2.0810).
• mksession writes terminal command unquoted (9.2.0811).
• :argdelete with pattern leads to wrong argidx() (9.2.0812).
• dict_add_func() may corrupt funcref count on failure (9.2.0813).
• Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
• deeply nested regexp patterns may cause stack overflow (9.2.0815).
• GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
• crash when building a stacktrace during an autocommand (9.2.0817).
• tests: client-server test fails without X11 server (9.2.0818).
• MS-Windows: sixel image shown as raw text in the console (9.2.0819).
• GUI: hidden popup image is displayed and not erased (9.2.0820).
• filetype: msmtp system-wide rc file not detected (9.2.0821).
• GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
• tests: Test_clientserver_servlist_list may fail (9.2.0823).
• Makefile: make tags depends on configure (9.2.0824).
• regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
• highlighting for broken…