* SECURITY UPDATE: out-of-bounds read when writing an IPTC output file (single-byte over-read) - debian/patches/CVE-2026-42326.patch: tighten the IPTC tag-length bound check in GetIPTCStream() in coders/meta.c - CVE-2026-42326 * SECURITY UPDATE: out-of-bounds over-read of 24 bytes during polynomial distortion - debian/patches/CVE-2026-45624.patch: validate the control-point argument count in GenerateCoefficients() in magick/distort.c - CVE-2026-45624 * SECURITY UPDATE: out-of-bounds write in the MIFF encoder when using LZMA compression - debian/patches/CVE-2026-46521.patch: include LZMAMaxExtent in the buffer-length computation and fail on LZMA-encoder errors in WriteMIFFImage() in coders/miff.c - CVE-2026-46521 * SECURITY UPDATE: stack overflow via a crafted MVG file (missing recursion-depth check) - debian/patches/CVE-2026-48734.patch: add a recursion-depth guard on nested MVG class expansion in RenderMVGContent() in magick/draw.c - CVE-2026-48734 * SECURITY UPDATE: heap buffer over-write in the MAT decoder on 32-bit systems (missing return-value check) - debian/patches/CVE-2026-48994.patch: check the quantum-format setters' return values and bail out on failure in ReadMATImageV4() in coders/mat.c - CVE-2026-48994 * SECURITY UPDATE: complete the CVE-2026-45664 MNG LOOP/ENDL loop-cap fix by releasing the chunk buffer before raising the resource-limit exception (heap memory leak on the loop-cap abort path) - debian/patches/CVE-2026-45664-1.patch: free chunk before both ThrowReaderException calls in ReadOneMNGImage() in coders/png.c - CVE-2026-45664