* SECURITY UPDATE: out-of-bounds write parsing a crafted spell file: tree_count_words() and sug_filltree() descended the word trie without bounding the recursion depth, so a deeply nested trie wrote past the ends of their MAXWLEN-sized arridx[], curi[] and wordcount[] arrays. - debian/patches/CVE-2026-55693.patch: only descend while depth < MAXWLEN - 1 in both trie walkers, in src/spell.c; matches upstream patch 9.2.0653. - CVE-2026-55693 * SECURITY UPDATE: stack out-of-bounds write in dump_prefixes() when dumping spell prefixes (:spelldump): the word trie was descended without bounding the recursion depth, overflowing the MAXWLEN-sized prefix[], arridx[] and curi[] arrays. - debian/patches/CVE-2026-55892.patch: only descend while depth < MAXWLEN - 1, in src/spell.c; matches upstream patch 9.2.0662. - CVE-2026-55892 * SECURITY UPDATE: out-of-bounds write in soundfold(): the single-byte branch of spell_soundfold_sofo() wrote one result byte per input byte into the MAXWLEN-sized res[] buffer with no bound, so a long word overflowed it. - debian/patches/CVE-2026-57455.patch: stop the translation loop once ri reaches MAXWLEN - 1, in src/spell.c; matches upstream patch 9.2.0698. - CVE-2026-57455 * SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: reconstructed class/function definitions ran through exec() embedded buffer-supplied docstrings inside a triple- quoted Python string literal, so a docstring containing a closing triple-quote broke out of the literal and executed attacker code. - debian/patches/CVE-2026-57456.patch: quote docstrings with repr() instead of triple-quoting, in runtime/autoload/python3complete.vim and pythoncomplete.vim; matches upstream patch 9.2.0699. - CVE-2026-57456