- CVE-2026-80101: size the XWD 1-bit scanline buffers on the number of bytes the decode loops actually read, ceil(width / 8), instead of trusting l_bytes_per_line alone, and zero-fill them; the upstream guard is re-authored because its own arithmetic is inoperative - CVE-2026-82343: reject PSD files whose declared channel count is below the minimum required by the color mode, so the merged image is no longer read with more bytes per pixel than were allocated (upstream's channel_idx array enlargement is not applicable: that write path does not exist in 2.99.8)