Multiple CVEs — including CVE-2026-34714 (fixed upstream in Vim 9.2.0272)

[poige]

Current public MacVim releases are listed as:

• r182: Vim 9.1.1887
• r182.1 prerelease: Vim 9.1.2068

These versions predate multiple upstream Vim security fixes from 2026, including:

• CVE-2026-28417, fixed in Vim 9.2.0073
• CVE-2026-33412, fixed in Vim 9.2.0202
• CVE-2026-34714, fixed in Vim 9.2.0272

Could you confirm whether these fixes were backported to MacVim, or whether an updated release is planned? CVE-2026-34714 looks especially relevant because it is triggered on opening a crafted file and mentions tabpanel.

[ychin]

Sorry for the delay. I think these all apply to MacVim. The most important one is probably the one fixed in 9.2.0272 (CVE-2026-34714). I just merged from upstream so the code now has all the fixes, and planning to release this weekend.