SECURITY UPDATE: heap buffer underwrite in the PICT decoder
debian/patches/CVE-2026-109964.patch: stop decoding when the row
pointer wraps below the pixel buffer in DecodeImage() in
coders/pict.c
CVE-2026-109964
SECURITY UPDATE: MVG command injection via the SVG decoder
debian/patches/CVE-2026-56379.patch: add SVGEscapeString() and escape
attribute and style values before writing them to the MVG stream in
SVGProcessStyleElement() and SVGStartElement() in coders/svg.c