SECURITY UPDATE: integer overflow in the pixel cache staging buffer size
debian/patches/CVE-2026-106571.patch: use overflow-checked
multiplications for the staging buffer size in
SetPixelCacheNexusPixels() in magick/cache.c
CVE-2026-106571
SECURITY UPDATE: coder security policy bypass
debian/patches/CVE-2026-106579.patch: check the coder name against the
coder policy at all four decoder and encoder calls, including the
WriteImage() fallback, in magick/constitute.c, and make the piddle
Magick++ demo tolerate the MVG write that the policy now denies in
Magick++/demo/piddle.cpp
CVE-2026-106579
SECURITY UPDATE: PostScript code injection through image labels
debian/patches/CVE-2026-106577.patch: add coders/ghostscript-private.h
with a shared EscapeParenthesis() that also escapes backslashes and
trims the label, and use it for the PS, PS2, PS3 and PDF labels, the PDF
title and producer, and the RenderPostscript() text in magick/annotate.c