* SECURITY UPDATE: integer overflow in the TIM reader leading to an out-of-bounds read on 32-bit systems - debian/patches/CVE-2025-66628.patch: compute image_size through HeapOverflowSanityCheckGetSize() and reject a size larger than the blob in ReadTIMImage() in coders/tim.c - CVE-2025-66628 * SECURITY UPDATE: infinite loop in the PCD decoder when the file has no valid Sync marker - debian/patches/CVE-2026-24485.patch: check the ReadBlob() return value in the PCDGetBits() macro and break out of the Sync-marker search on a short read in DecodeImage() in coders/pcd.c - CVE-2026-24485 * SECURITY UPDATE: stack buffer overflow when parsing an over-long morphology kernel specification - debian/patches/CVE-2026-28494.patch: clamp the geometry substring length to sizeof(token)-1 in ParseKernelArray() and ParseKernelName() in magick/morphology.c - CVE-2026-28494 * SECURITY UPDATE: uninitialized pointer dereference in the JBIG decoder on a truncated or corrupt stream - debian/patches/CVE-2026-28691.patch: throw a corrupt image exception when the decode loop does not finish with JBG_EOK in ReadJBIGImage() in coders/jbig.c - CVE-2026-28691 * SECURITY UPDATE: integer overflow in the DIB coder leading to an out-of-bounds read or write - debian/patches/CVE-2026-28693.patch: compute bytes_per_line and length through HeapOverflowSanityCheckGetSize() and make the blob-size check overflow-free in ReadDIBImage() and WriteDIBImage() in coders/dib.c - CVE-2026-28693