- CVE-2026-86138: add overflow checks to xmlDictAddQString pool size calculation and bound the QName lengths in its caller xmlDictQLookup to prevent heap buffer overflow when interning long QNames - CVE-2026-86140: add bounds checks around the englobing parenthesis strcat() calls in xmlSnprintfElements to prevent stack buffer overflow - CVE-2026-86142: reject XPointer parts whose length is not representable as an int in xmlXPtrEvalXPtrPart to prevent heap buffer overflow