- CVE-2026-18301: validate the PSD channel data allocation with a checked multiplication and fail cleanly instead of overflowing the raw_data buffer - CVE-2026-18302: pass the correct row stride to convert_int2uint() when loading separate-plane TIFFs so the conversion cannot write past the end of the heap-allocated row buffer - CVE-2026-18303: reject indexed TIFFs whose bit depth implies a color map larger than 256 entries instead of overrunning the 768-byte stack cmap - CVE-2026-18304: compute the TIFF upscale tile area as gsize and use a checked allocation so an integer overflow cannot undersize bw_buffer - CVE-2026-18305: use checked multiplications for the TIFF RGBA image allocation instead of an overflowing width times height product - CVE-2026-18306: reject SGI files whose bits-per-pixel is outside the supported range of 1 to 2 and cast the SGI row pointer arithmetic to gsize so an integer overflow cannot lead to an out-of-bounds write - CVE-2026-18307: derive the TIFF bytes-per-pixel consistency check from the source babl format so a samples-per-pixel below the photometric setting cannot undercount the buffer size, and size the contiguous tile buffer with checked multiplications instead of trusting TIFFTileSize()