new file mode 100644
@@ -0,0 +1,103 @@
+From d64909ac1939bc91784de7f9b8d7705623d59f64 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Mon, 15 Jun 2026 19:39:08 +0000
+Subject: [PATCH] patch 9.2.0653: [security]: out-of-bounds write in
+ tree_count_words()
+
+Problem: [security]: a crafted spell file can drive tree_count_words()
+ past the end of its MAXWLEN-sized depth arrays; the descent
+ loop has no depth bound.
+Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
+ walkers already do; apply the same guard to sug_filltree().
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
+
+Supported by AI.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7]
+CVE: CVE-2026-55693
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ src/spellfile.c | 4 ++--
+ src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/src/spellfile.c b/src/spellfile.c
+index 5102dad5b..b3ee9c0d6 100644
+--- a/src/spellfile.c
++++ b/src/spellfile.c
+@@ -642,7 +642,7 @@ tree_count_words(char_u *byts, idx_T *idxs)
+ ++curi[depth];
+ }
+ }
+- else
++ else if (depth < MAXWLEN - 1)
+ {
+ // Normal char, go one level deeper to count the words.
+ ++depth;
+@@ -5656,7 +5656,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang)
+ ++curi[depth];
+ }
+ }
+- else
++ else if (depth < MAXWLEN - 1)
+ {
+ // Normal char, go one level deeper.
+ tword[depth++] = c;
+diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim
+index 8f3ef4907..5b2ed4efd 100644
+--- a/src/testdir/test_spellfile.vim
++++ b/src/testdir/test_spellfile.vim
+@@ -1197,4 +1197,31 @@ func Test_mkspell_no_buffer_overflow()
+ endfunc
+
+
++func Test_spell_sug_tree_count_words_overflow()
++ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree
++ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth
++ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth
++ " arrays -> stack out-of-bounds write. The walk only happens when
++ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB.
++ call mkdir('Xrtp/spell', 'pR')
++ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'},
++ " empty KWORDTREE/PREFIXTREE
++ let spl = eval('0z56494D7370656C6C320B0000000008000000001234'
++ \ .. '5678FF000000020101000000410000000000000000')
++ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE
++ let sug = 0z56494D737567010000000012345678000000040161010000000000
++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
++ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b')
++
++ new
++ set runtimepath+=./Xrtp
++ set spelllang=xx
++ set spell
++ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list.
++ call assert_equal(v:t_list, type(spellsuggest('helloo')))
++
++ set spell& spelllang& runtimepath&
++ bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index 6eac3fc92..e7f323854 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -736,6 +736,8 @@ static int included_patches[] =
+ { /* Add new patch number below this line */
+ /**/
+ 671,
++/**/
++ 653,
+ /**/
+ 662,
+ /**/
+--
+2.53.0
+
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-47167.patch \
file://CVE-2026-55892.patch \
file://CVE-2026-57452.patch \
+ file://CVE-2026-55693.patch \
"
PV .= ".0340"