Repository navigation
Multiple CVEs — including CVE-2026-34714 (fixed upstream in Vim 9.2.0272) #1634
Description
Current public MacVim releases are listed as:
- r182: Vim 9.1.1887
- r182.1 prerelease: Vim 9.1.2068
These versions predate multiple upstream Vim security fixes from 2026, including:
- CVE-2026-28417, fixed in Vim 9.2.0073
- CVE-2026-33412, fixed in Vim 9.2.0202
- CVE-2026-34714, fixed in Vim 9.2.0272
Could you confirm whether these fixes were backported to MacVim, or whether an updated release is planned? CVE-2026-34714 looks especially relevant because it is triggered on opening a crafted file and mentions tabpanel.
Activity
ychin commentedon Apr 5, 2026
Sorry for the delay. I think these all apply to MacVim. The most important one is probably the one fixed in 9.2.0272 (CVE-2026-34714). I just merged from upstream so the code now has all the fixes, and planning to release this weekend.
adudek16 commentedon Jun 2, 2026
Can you update to pull in several fixes for recently published CVEs?
adudek16 commentedon Aug 6, 2026
Can you resync with vim to close
2026-59857
2026-55895
2026-5569[23]
2026-5745[1-6]
so vim 9.2.0810 or later