out-of-bounds read in gcharcursor() in misc1.c (CVE-2022-1851) use-after-free in findpatterninpath() in search.c (CVE-2022-1898) out-of-bounds write in vimregsubboth() in regexp.c (CVE-2022-1897) buffer over-read in utfptr2char() in mbyte.c (CVE-2022-1927 ) out of bounds write in vimregsubboth() (CVE-2022-1942) heap-based buffer overflow in function utfhead_off (CVE-2022-1886)