* SECURITY UPDATE: heap buffer overflows and out-of-bounds read in index handling - debian/patches/CVE-2026-42617_CVE-2026-46572_CVE-2026-56136.patch: validate the index entry stream and INDEX_ROOT.index_block_size read from disk, and check the size copied from the index root to the new index block in ntfs_ir_to_ib(), in include/ntfs-3g/index.h, libntfs-3g/attrib.c and libntfs-3g/index.c. - CVE-2026-42617 - CVE-2026-46572 - CVE-2026-56136 * SECURITY UPDATE: heap buffer overflow in index block split - debian/patches/CVE-2026-46569.patch: bound tail_size against the destination block capacity in ntfs_ib_copy_tail() in libntfs-3g/index.c. - CVE-2026-46569 * SECURITY UPDATE: out-of-bounds write when walking a deep index - debian/patches/CVE-2026-46570.patch: limit the B-tree depth to MAX_PARENT_VCN in ntfs_index_walk_down() in libntfs-3g/index.c. - CVE-2026-46570 * Fix double free when an index entry is too long to hold a VCN - debian/patches/index-reject-entry-too-long-for-vcn.patch: reject an index entry that is too long to hold a VCN in ntfs_ie_add_vcn() in libntfs-3g/index.c, as its 16-bit length would wrap to zero. * SECURITY UPDATE: heap buffer overflow in LZNT1 decompression - debian/patches/CVE-2026-42618.patch: end a sub-block when its output is full and check the input bounds before reading sub-block headers and phrase tokens in ntfs_decompress() in libntfs-3g/compress.c, and zero the unused part of the output when the compressed data is garbled. - CVE-2026-42618 * SECURITY UPDATE: heap buffer overflow in ntfscat - debian/patches/CVE-2026-42616.patch: size the read buffer from the block size in cat() in ntfsprogs/ntfscat.c. - CVE-2026-42616