- CVE-2026-33983: fix undefined-behaviour shift and ~80 billion iteration loop (CPU denial of service) in the progressive codec; make progressive_rfx_quant_sub reject components where q1 < q2 instead of letting the BYTE subtraction underflow into a bogus numBits shift exponent, and fail the tile upgrade when it does - CVE-2026-33984: fix out-of-bounds heap write in the CLEAR codec; update CLEAR_VBAR_ENTRY::size only after the pixel buffer realloc succeeded, so a failed realloc can no longer leave an inflated size with the old, smaller buffer