- CVE-2026-56361: out-of-bounds access in AcquireKernelBuiltIn() when a user kernel offset equals the kernel width or height - CVE-2026-56367: heap overflow from an unchecked rows*channels multiplication in the PSD RLE size reader - CVE-2026-56368: memory leak of the quantum info buffer in the raw pixel writers (bgr, cmyk, gray, rgb, ycbcr) on output blob reopen failure - CVE-2026-56370: out-of-bounds write in ConnectedComponentsImage() via crafted connected-components:keep and :remove index ranges - CVE-2026-56378: out-of-bounds read in the PCD Huffman decoder from an unbounded output pointer