- CVE-2023-1170: at the end of do_put() (ops.c), clamp the cursor column back to the line length (and recompute coladd under virtualedit=all) so a Visual block put past the new NUL no longer leaves the cursor pointing past end-of-line. - CVE-2023-1175: in op_yank() (ops.c), when the yank starts inside a multi-cell tab under virtual editing, clamp bd.startspaces to 0 before incrementing startcol so a negative width can't drive the later block-yank copy out of bounds. - CVE-2023-1264: in vgetorpeek() (getchar.c), guard the dead-character putcmdline()/unputcmdline() paths with cmdline_has_buffer() (new ex_getln.c helper) so a nested :open command with a NULL ccline.cmdbuff no longer dereferences it.