- CVE-2022-2125: fix out-of-bounds read in get_lisp_indent(); break out of the inner loop on NUL byte (indent.c, upstream patch 8.2.5122) - CVE-2021-3974: fix use-after-free in nfa_regmatch() when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reg_getline() after getmark_buf() (regexp.c + regexp_nfa.c, upstream patch 8.2.3612) - CVE-2022-2206: fix OOB read after terminal resize lowers Rows below cmdline_row / msg_row; clamp both to Rows - 1 in check_shellsize() (term.c, upstream patch 8.2.5160) - CVE-2022-2946: fix use-after-free in do_tag() when 'tagfunc' deletes the buffer; make a vim_strsave copy of the tagstack tagname before calling user code (tag.c, upstream patch 9.0.0246) - CVE-2022-2286: fix heap-buffer-overflow in the Ctrl-E completion-stop path when the completion leader shrinks below the original text; bounds-check compl_len against replacement string length before ins_bytes_len() (insexpand.c, upstream patch 9.0.0020)