Security update for vim

The vim update to version 9.2.0780 fixes three security vulnerabilities: CVE-2026-59856 and CVE-2026-59858, which are arbitrary code execution flaws caused by improper escaping in PHP and C omni-completion features respectively, and CVE-2026-59857, an out-of-bounds write vulnerability in SAL soundfolding due to improper bounds checking. These vulnerabilities could allow attackers to execute arbitrary code or cause memory corruption. The update also includes a wide range of non-security related bug fixes and enhancements.

Successful exploitation of CVE-2026-59856 and CVE-2026-59858 could lead to arbitrary code execution, potentially allowing attackers to run malicious code within the context of the vim process. CVE-2026-59857 could result in memory corruption through an out-of-bounds write, which may lead to crashes or potentially exploitable conditions. These issues pose a high security risk to users running affected versions of vim.

Users should update vim to version 9.2.0780 or later to remediate these vulnerabilities. This update contains official fixes for the identified security issues. No additional mitigation steps are indicated beyond applying this security update.