- CVE-2026-18295: qtmoovrecover: validate box sizes when parsing MRF recovery files to prevent an out-of-bounds write - CVE-2026-18296: qtmoovrecover: validate minimum atom sizes when parsing MRF recovery files to prevent a heap buffer overflow - CVE-2026-18298: gdkpixbufdec: handle format and resolution changes correctly to prevent a heap buffer overflow - CVE-2026-18299: rtpsbcdepay: check for available data in the adapter and for a large enough payload header to prevent an out-of-bounds read and use-after-free