* SECURITY UPDATE: stack-based buffer overflow in option callback functions: illegal_char() and did_set_string_option() wrote the E539/E526/E535 option errors into the caller's 80-byte errbuf[] with unbounded sprintf(). The call site reported upstream, did_set_langmap() in src/map.c, does not exist in this version, where 'langmap' errors are reported through EMSG2() into a bounded buffer. - debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142. - CVE-2024-22667 * SECURITY UPDATE: buffer overflow in 'helpfile' option handling: get_tagfname() copied the user-controlled 'helpfile' value into a MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so an over-long 'helpfile' overflowed the buffer. - debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133. - CVE-2026-25749 * SECURITY UPDATE: buffer overflow in the netbeans specialKeys command: special_keys() walked the modifier prefix writing two bytes per modifier into the 64-byte keybuf[] with no bound, so a long modifier run overflowed it. - debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148. - CVE-2026-26269 * SECURITY UPDATE: command injection via netrw URIs: the hostname and port taken from a netrw URI were interpolated unescaped into the command passed to system(), so shell metacharacters in the host or port ran arbitrary commands. - debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553. - CVE-2026-28417 * SECURITY UPDATE: crash and huge allocation recovering a corrupted swap file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and pe_line_count from the swap file, so bogus values caused a multi-GB mf_get() allocation or a SEGV inside readfile(). - debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077. - CVE-2026-28421 * SECURITY UPDATE: command injection via newline in glob(): the newline character was missing from SHELL_SPECIAL, so it was not escaped before mch_expand_wildcards() handed the pattern to the shell and could act as a command separator. - debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202. - CVE-2026-33412 * SECURITY UPDATE: modeline security bypass: several options holding expressions could be set from a modeline, so opening a crafted file evaluated attacker-supplied expressions. In this version the expressions reachable this way are the 'statusline'-style %{} items of 'printheader' and 'guitabtooltip', which were evaluated in the sandbox only; the F{func} flag of 'complete' and the mapset() function named by the upstream advisory arrived in later releases and are not present in this version. - debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite for the fix below. - debian/patches/patch-8.1.1367-can-set-modelineexpr-in-modeline.patch: mark 'modelineexpr' itself P_SECURE so a modeline cannot enable it, and document that, in src/option.c and runtime/doc/options.txt; without this the check above can be turned off by the crafted file itself. - debian/patches/CVE-2026-34982.patch: mark 'complete', 'guitabtooltip' and 'printheader' P_MLE, in src/option.c; matches upstream patch 9.2.0276. - CVE-2026-34982 * SECURITY UPDATE: path traversal in zip.vim: neither zip#Write() nor zip#Extract() rejected archive members whose path escaped the extraction directory, so a crafted zip could write outside it. - debian/patches/CVE-2026-35177.patch: reject any path that simplifies to one containing "../" in both zip#Write() and zip#Extract(), in runtime/autoload/zip.vim; matches upstream patch 9.2.0280. - CVE-2026-35177 * SECURITY UPDATE: command injection in the netbeans interface via defineAnnoType: typeName, fg and bg arrived unvalidated from the NetBeans server and were interpolated into an Ex command, so a bar could append arbitrary commands; specialKeys likewise built a map command from an unvalidated key token. - debian/patches/CVE-2026-39881.patch: validate typeName, fg and bg against character allowlists and accept only alphanumerics and '-' in a specialKeys token, in src/netbeans.c; matches upstream patch 9.2.0316. - CVE-2026-39881 * SECURITY UPDATE: command injection via backticks in tag files: expand_tag_fname() passed a tag filename containing backticks to wildcard expansion, which ran it through the shell. - debian/patches/CVE-2026-41411.patch: refuse to expand a tag filename containing a backtick, in src/tag.c; matches upstream patch 9.2.0357. - CVE-2026-41411 * NOTE: behaviour change that comes with the 'modelineexpr' mechanism above: options that hold an expression ('balloonexpr', 'foldexpr', 'foldtext', 'formatexpr', 'guitablabel', 'iconstring', 'includeexpr', 'indentexpr', 'rulerformat', 'statusline', 'tabline', 'titlestring', 'complete', 'guitabtooltip' and 'printheader') can no longer be set from a modeline unless the new 'modelineexpr' option is on, and are refused with E992. 'cdpath' becomes modeline- and sandbox-refused (E520). This is the upstream 8.1.1366 behaviour; see :help modelineexpr. * debian/patches/fix-Test_terminal_cwd.patch: join the first two terminal lines before comparing in Test_terminal_cwd(), so the test still passes when the build path is long enough for the pwd output to wrap; matches upstream patch 9.0.0541.