* SECURITY UPDATE: stack buffer overflow in xmlSnprintfElements() - debian/patches/CVE-2026-86140.patch: add bounds checks around the parenthesis writes in xmlSnprintfElements() in valid.c - CVE-2026-86140 * SECURITY UPDATE: NULL pointer dereference in xmlRegNewParserCtxt() after a failed allocation - debian/patches/CVE-2026-86141.patch: check the xmlStrdup() result in xmlRegNewParserCtxt() in xmlregexp.c so a failed allocation cannot leave a NULL parser cursor - CVE-2026-86141 * SECURITY UPDATE: heap buffer overflow in xmlXPtrEvalXPtrPart() on oversized xpointer() expressions - debian/patches/CVE-2026-86142.patch: make xmlStrlen() in xmlstring.c saturate above INT_MAX and reject the saturated length in xmlXPtrEvalXPtrPart() in xpointer.c before sizing the buffer - CVE-2026-86142 * SECURITY UPDATE: integer overflow before the output write callback - debian/patches/CVE-2026-86143.patch: check for integer overflow before passing a buffer length to the write callback in xmlIO.c - CVE-2026-86143 * SECURITY UPDATE: parse flags not propagated by xmlXIncludeProcess() and xmlXIncludeProcessTree() - debian/patches/CVE-2026-86144.patch: propagate the document parse flags in xmlXIncludeProcess() and xmlXIncludeProcessTree() in xinclude.c - CVE-2026-86144