SECURITY UPDATE: Heap buffer over-write in the JP2 encoder via jp2:quality
and jp2:rate options
debian/patches/CVE-2026-46559.patch: bound the jp2:quality and jp2:rate
parse loops by the tcp_distoratio/tcp_rates array extent in
WriteJP2Image() in coders/jp2.c
CVE-2026-46559
SECURITY UPDATE: Invalid image dimensions in the DCM decoder leading to
crashes in later operations
debian/patches/CVE-2026-49218.patch: reject an image with zero rows or
columns at the end of ReadDCMImage() in coders/dcm.c
CVE-2026-49218
SECURITY UPDATE: Out-of-memory condition via missing maximum memory request
check in AcquireAlignedMemory
debian/patches/CVE-2026-53460.patch: reject allocation sizes greater than
GetMaxMemoryRequest() in AcquireAlignedMemory() in magick/memory.c