- CVE-2026-33900: fix integer truncation in viff encoder leading to heap out-of-bounds write on 32-bit builds - CVE-2026-33905: fix out-of-bounds read in -sample operation via sample:offset define - CVE-2026-34238: fix integer overflow in despeckle operation causing heap buffer overflow on 32-bit builds - CVE-2026-40310: fix heap out-of-bounds write in JP2 encoder on invalid sampling index - CVE-2026-40311: fix heap use-after-free reading and printing values from an invalid XMP profile