SECURITY UPDATE: denial of service in the MVG/SVG renderer when a bezier
control-point coordinate delta is out of range
debian/patches/CVE-2026-25985.patch: reject an out-of-range coordinate
delta before the (size_t) conversion, release points/coefficients on
the error paths instead of raising a fatal exception, and refresh
primitive_info after the CheckPrimitiveExtent() reallocation, in
TraceBezier() in magick/draw.c
CVE-2026-25985
SECURITY UPDATE: off-by-one boundary check in the double-to-integer cast
helpers leading to an undefined conversion
debian/patches/CVE-2026-25989.patch: make the upper-bound guard of
CastDoubleToUnsigned() and CastDoubleToLong() exclusive of the boundary
value in magick/image-private.h