- CVE-2026-59691: fix a heap buffer overflow in the rfbsrc RRE, CoRRE and hextile decoders, which wrote 32-bit pixels into a buffer sized for the negotiated bits-per-pixel; write through the correct type for 1, 2 and 4 bytespp and reject any other format, and read colour values at the negotiated width at all seven call sites instead of a fixed four bytes - CVE-2026-59692: fix a stack buffer overflow in the DTLS connection handler, which printed the peer certificate subject DN into a fixed 2048-byte stack buffer; allocate it from the returned length instead and bound the read