* SECURITY UPDATE: integer overflow in the TIM reader - debian/patches/CVE-2025-66628.patch: guard the image_size computation in ReadTIMImage with HeapOverflowSanityCheckGetSize (coders/tim.c). Upstream's companion "image_size > GetBlobSize(image)" early reject is deliberately not carried: GetBlobSize is only authoritative for regular files and in-memory blobs, so it would reject valid TIM images read from a FIFO, from stdin or a pipe, or from a gzip/bzip2 stream - CVE-2025-66628 * SECURITY UPDATE: infinite loop in the PCD reader on a missing Sync marker - debian/patches/CVE-2026-24485.patch: track the ReadBlob return in the PCDGetBits macro and bail out on a short read, and carry the upstream prerequisite that makes the Sync search and the decode loop terminate on EOF -- without it the macro's bare "break" only leaves the innermost recovery loop and DecodeImage still spins (coders/pcd.c) - CVE-2026-24485 * SECURITY UPDATE: off-by-one out-of-range cast in the CastDouble* helpers - debian/patches/CVE-2026-25989.patch: reject a value equal to the type maximum in CastDoubleToLong and CastDoubleToQuantumAny (magick/image-private.h) - CVE-2026-25989