CVE-2026-39881

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.(CVE-2026-39881)

Root has patched CVE-2026-39881 in the vim package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-39881 in the vim package for Root:Debian:12. Multiple fixed versions available.

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

• CVE-2026-39881: fix command injection in netbeans interface by validating defineAnnoType typeName/fg/bg and specialKeys tokens against an allowlist of safe characters before interpolating them into Ex commands

• CVE-2026-39881: fix command injection in netbeans interface by validating defineAnnoType typeName/fg/bg and specialKeys tokens against an allowlist of safe characters before interpolating them into Ex commands

• SECURITY UPDATE: Command injection in netbeans interface
  • debian/patches/CVE-2026-39881.patch: add nb_is_safe_string() in src/netbeans.c and validate typeName, fg and bg in defineAnnoType and key tokens in special_keys() against an allowlist before they reach coloncmd()/do_map(), preventing a malicious netbeans server from injecting Ex commands via '|'
  • CVE-2026-39881

• CVE-2026-35177: fix path traversal bypass in zip.vim by using simplify() to detect attacks that circumvent the previous regex-only check
• CVE-2026-39881: fix command injection in netbeans interface via unsanitized defineAnnoType and specialKeys parameters

• SECURITY UPDATE: fix command injection in netbeans interface via defineAnnoType (validate typeName/fg/bg/specialKeys)
  • debian/patches/CVE-2026-39881.patch: fix command injection in netbeans interface via defineAnnoType (validate typeName/fg/bg/specialKeys)
  • CVE-2026-39881

• CVE-2026-35177: fix path traversal bypass in zip.vim by using simplify() to detect attacks that circumvent the previous regex-only check
• CVE-2026-39881: fix command injection in netbeans interface via unsanitized defineAnnoType and specialKeys parameters

• CVE-2026-39881: fix netbeans defineAnnoType command injection by validating typeName, fg and bg against an allowlist before passing them to coloncmd(); also restrict specialKeys tokens to alphanumeric characters to prevent map command injection

• CVE-2026-39881: fix netbeans defineAnnoType command injection by validating typeName, fg and bg against an allowlist before passing them to coloncmd(); also restrict specialKeys tokens to alphanumeric characters to prevent map command injection

• CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)
• CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)
• CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)
• CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)
• CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)
• CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)
• CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)
• CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)
• CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)
• CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)
• CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)
• CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)
• CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)
• CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)
• CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)
• CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)
• CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)
• CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)
• CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)
• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

• SECURITY UPDATE: stack-based buffer overflow in option callback functions: illegal_char() and did_set_string_option() wrote the E539/E526/E535 option errors into the caller's 80-byte errbuf[] with unbounded sprintf(). The call site reported upstream, did_set_langmap() in src/map.c, does not exist in this version, where 'langmap' errors are reported through EMSG2() into a bounded buffer.
  • debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142.
  • CVE-2024-22667
• SECURITY UPDATE: buffer overflow in 'helpfile' option handling: get_tagfname() copied the user-controlled 'helpfile' value into a MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so an over-long 'helpfile' overflowed the buffer.
  • debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133.
  • CVE-2026-25749
• SECURITY UPDATE: buffer overflow in the netbeans specialKeys command: special_keys() walked the modifier prefix writing two bytes per modifier into the 64-byte keybuf[] with no bound, so a long modifier run overflowed it.
  • debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148.
  • CVE-2026-26269
• SECURITY UPDATE: command injection via netrw URIs: the hostname and port taken from a netrw URI were interpolated unescaped into the command passed to system(), so shell metacharacters in the host or port ran arbitrary commands.
  • debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553.
  • CVE-2026-28417
• SECURITY UPDATE: crash and huge allocation recovering a corrupted swap file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and pe_line_count from the swap file, so bogus values caused a multi-GB mf_get() allocation or a SEGV inside readfile().
  • debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077.
  • CVE-2026-28421
• SECURITY UPDATE: command injection via newline in glob(): the newline character was missing from SHELL_SPECIAL, so it was not escaped before mch_expand_wildcards() handed the pattern to the shell and could act as a command separator.
  • debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202.
  • CVE-2026-33412
• SECURITY UPDATE: modeline security bypass: several options holding expressions could be set from a modeline, so opening a crafted file evaluated attacker-supplied expressions. In this version the expressions reachable this way are the 'statusline'-style %{} items of 'printheader' and 'guitabtooltip', which were evaluated in the sandbox only; the F{func} flag of 'complete' and the mapset() function named by the upstream advisory arrived in later releases and are not present in this version.
  • debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite…

Ex command injection in Vims NetBeans integration. (CVE-2026-39881) Command injection via backtick expansion in tag filenames in Vim < v9.2.0357. (CVE-2026-41411) OS Command Injection in netrw affects Vim < 9.2.0383. (CVE-2026-42307) OS Command Injection via 'path' completion affects Vim < 9.2.0435.

These are all security issues fixed in the gvim-9.2.0398-1.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issue:

Security fixes:

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).

Other fixes:

• Update to 9.2.0398.

• 9.2.0398: MS-Windows: missing strptime() support
• 9.2.0397: tabpanel: double-click opens a new tab
• 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS
• 9.2.0395: tests: Test_backupskip() may read from $HOME
• 9.2.0394: xxd: offsets greater than LONG_MAX print as negative
• 9.2.0393: MS-Windows: link error with XPM support on UCRT64
• 9.2.0392: tests: Some tests are flaky
• 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting
• 9.2.0390: filetype: some Beancount files are not recognized
• 9.2.0389: DECRQM still leaves stray 'pp' on Apple Terminal.app
• 9.2.0388: strange indent in update_topline()
• 9.2.0387: DECRQM request may leave stray chars in terminal
• 9.2.0386: No scroll/scrollbar support in the tabpanel
• 9.2.0385: Integer overflow with 'ze' and large 'sidescrolloff'
• 9.2.0384: stale Insstart after <Cmd> cursor move breaks undo
• 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs
• 9.2.0382: Wayland: focus-stealing is non-working
• 9.2.0381: Vim9: Missing check_secure() in exec_instructions()
• 9.2.0380: completion: a few issues in completion code
• 9.2.0379: gui.color_approx is never used
• 9.2.0378: Using int as bool type in win_T struct
• 9.2.0377: Using int as bool type in gui_T struct
• 9.2.0376: Vim9: elseif condition compiled in dead branch
• 9.2.0375: prop_find() does not find a virt text in starting line
• 9.2.0374: c_CTRL-{G,T} does not handle offset
• 9.2.0373: Ctrl-R mapping not triggered during completion
• 9.2.0372: pum: rendering issues with multibyte text and opacity
• 9.2.0371: filetype: ghostty config files are not recognized
• 9.2.0370: duplicate code with literal string_T assignment
• 9.2.0369: multiple definitions of STRING_INIT macro
• 9.2.0368: too many strlen() calls when adding strings to dicts
• 9.2.0367: runtime(netrw): ~ note expanded on MS Windows
• 9.2.0366: pum: flicker when updating pum in place
• 9.2.0365: using int as bool
• 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails
• 9.2.0363: Vim9: variable shadowed by script-local function
• 9.2.0362: division by zero with smoothscroll and small windows
• 9.2.0361: tests: no tests for ch_listen() with IPs
• 9.2.0360: Cannot handle mouse-clicks in the tabpanel
• 9.2.0359: wrong VertSplitNC highlighting on winbar
• 9.2.0358: runtime(vimball): still path traversal attacks possible
• 9.2.0357: [security]: command injection via backticks in tag files
• 9.2.0356: Cannot apply 'scrolloff' context lines at end of file
• 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()
• 9.2.0354: filetype: not all Bitbake include files are recognized
• 9.2.0353: Missing out-of-memory check in register.c
• 9.2.0352: 'winhighlight' of left window blends into right window
• 9.2.0351: repeat_string() can be improved
• 9.2.0350: Enabling modelines poses a risk
• 9.2.0349: cannot style non-current window separator
• 9.2.0348: potential buffer underrun when setting statusline like option
• 9.2.0347: Vim9: script-local variable not found
• 9.2.0346: Wrong cursor position when entering command line window
• 9.2.0345: Wrong autoformatting with 'autocomplete'
• 9.2.0344: channel: ch_listen() can bind to network interface
• 9.2.0343: tests: test_clientserver may fail on slower systems
• 9.2.0342: tests: test_excmd.vim leaves swapfiles behind
• 9.2.0341: some functions can be run from the sandbox
• 9.2.0340: pum_redraw() may cause flicker
• 9.2.0339: regexp: nfa_regmatch() allocates and frees too often
• 9.2.0338: Cannot handle mouseclicks in the tabline
• 9.2.0337: list indexing broken on big-endian 32-bit platforms
• 9.2.0336: libvterm: no terminal reflow support
• 9.2.0335: json_encode() uses recursive…

This update for vim fixes the following issue:

Security fixes:

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).

Other fixes:

• Update to 9.2.0398.

• 9.2.0398: MS-Windows: missing strptime() support
• 9.2.0397: tabpanel: double-click opens a new tab
• 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS
• 9.2.0395: tests: Test_backupskip() may read from $HOME
• 9.2.0394: xxd: offsets greater than LONG_MAX print as negative
• 9.2.0393: MS-Windows: link error with XPM support on UCRT64
• 9.2.0392: tests: Some tests are flaky
• 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting
• 9.2.0390: filetype: some Beancount files are not recognized
• 9.2.0389: DECRQM still leaves stray 'pp' on Apple Terminal.app
• 9.2.0388: strange indent in update_topline()
• 9.2.0387: DECRQM request may leave stray chars in terminal
• 9.2.0386: No scroll/scrollbar support in the tabpanel
• 9.2.0385: Integer overflow with 'ze' and large 'sidescrolloff'
• 9.2.0384: stale Insstart after <Cmd> cursor move breaks undo
• 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs
• 9.2.0382: Wayland: focus-stealing is non-working
• 9.2.0381: Vim9: Missing check_secure() in exec_instructions()
• 9.2.0380: completion: a few issues in completion code
• 9.2.0379: gui.color_approx is never used
• 9.2.0378: Using int as bool type in win_T struct
• 9.2.0377: Using int as bool type in gui_T struct
• 9.2.0376: Vim9: elseif condition compiled in dead branch
• 9.2.0375: prop_find() does not find a virt text in starting line
• 9.2.0374: c_CTRL-{G,T} does not handle offset
• 9.2.0373: Ctrl-R mapping not triggered during completion
• 9.2.0372: pum: rendering issues with multibyte text and opacity
• 9.2.0371: filetype: ghostty config files are not recognized
• 9.2.0370: duplicate code with literal string_T assignment
• 9.2.0369: multiple definitions of STRING_INIT macro
• 9.2.0368: too many strlen() calls when adding strings to dicts
• 9.2.0367: runtime(netrw): ~ note expanded on MS Windows
• 9.2.0366: pum: flicker when updating pum in place
• 9.2.0365: using int as bool
• 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails
• 9.2.0363: Vim9: variable shadowed by script-local function
• 9.2.0362: division by zero with smoothscroll and small windows
• 9.2.0361: tests: no tests for ch_listen() with IPs
• 9.2.0360: Cannot handle mouse-clicks in the tabpanel
• 9.2.0359: wrong VertSplitNC highlighting on winbar
• 9.2.0358: runtime(vimball): still path traversal attacks possible
• 9.2.0357: [security]: command injection via backticks in tag files
• 9.2.0356: Cannot apply 'scrolloff' context lines at end of file
• 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()
• 9.2.0354: filetype: not all Bitbake include files are recognized
• 9.2.0353: Missing out-of-memory check in register.c
• 9.2.0352: 'winhighlight' of left window blends into right window
• 9.2.0351: repeat_string() can be improved
• 9.2.0350: Enabling modelines poses a risk
• 9.2.0349: cannot style non-current window separator
• 9.2.0348: potential buffer underrun when setting statusline like option
• 9.2.0347: Vim9: script-local variable not found
• 9.2.0346: Wrong cursor position when entering command line window
• 9.2.0345: Wrong autoformatting with 'autocomplete'
• 9.2.0344: channel: ch_listen() can bind to network interface
• 9.2.0343: tests: test_clientserver may fail on slower systems
• 9.2.0342: tests: test_excmd.vim leaves swapfiles behind
• 9.2.0341: some functions can be run from the sandbox
• 9.2.0340: pum_redraw() may cause flicker
• 9.2.0339: regexp: nfa_regmatch() allocates and frees too often
• 9.2.0338: Cannot handle mouseclicks in the tabline
• 9.2.0337: list indexing broken on big-endian 32-bit platforms
• 9.2.0336: libvterm: no terminal reflow support
• 9.2.0335: json_encode() uses recursive…

This update for vim fixes the following issue:

Update to version 9.2.0398.

Security issues fixed:

• CVE-2026-39881: missing sanitization in defineAnnoType and specialKeys can lead to arbitrary Ex command injection via a malicious NetBeans server (bsc#1261833).

This update for vim fixes the following issue:

Update to version 9.2.0398.

Security issues fixed:

• CVE-2026-39881: missing sanitization in defineAnnoType and specialKeys can lead to arbitrary Ex command injection via a malicious NetBeans server (bsc#1261833).

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

This update for vim fixes the following issues

• CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
• CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
• CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
• CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
• CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
• CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

• Update to v9.2.0530.
• Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)