- CVE-2022-2175: fix invalid memory access in cmdline_insert_reg() when using an expression on the command line; save/restore new_cmdpos around the expression evaluation (ex_getln.c, upstream patch 8.2.5148; hunk 3 context adjusted for 8.2.2637) - CVE-2022-3256: fix use-after-free in movemark() when an autocommand changes the mark; make a local copy of the fmark before potentially triggering buffer autocommands (mark.c, upstream patch 9.0.0530) - CVE-2022-4292: fix use-after-free in did_set_spelllang() when a SpellFileMissing autocommand uses :bwipe to close the current window; also bail out when the window is no longer valid (spell.c, upstream patch 9.0.0882) - CVE-2022-3324: fix negative-index buffer access caused by negative window width; clamp next_curwin_size in win_equal_rec() and clamp wp->w_width in win_new_width() (window.c, upstream patch 9.0.0598)