CVE-2023-4156: builtin.c (format_tree): when collecting positional field widths or precisions, check for wrap around to negative values
CVE-2026-40469: builtin.c (sub_common): check for overflow in the result buffer size calculation using 64-bit math, failing with a fatal error instead of corrupting the heap on 32-bit builds