* SECURITY UPDATE: out-of-bounds write in MakerNote value formatting - debian/patches/CVE-2026-32775.patch: reject maxlen == 0 before the maxlen-- underflow in mnote_canon_entry_get_value(), mnote_fuji_entry_get_value(), mnote_olympus_entry_get_value() and mnote_pentax_entry_get_value(). - CVE-2026-32775 * SECURITY UPDATE: integer overflow when reading Nikon MakerNotes - debian/patches/CVE-2026-40385.patch: bound the offset read from the MakerNote before adding it to datao in exif_mnote_data_olympus_load(), which could wrap on 32-bit size_t and lead to out-of-bounds reads. - CVE-2026-40385 * SECURITY UPDATE: unsigned integer underflow in MakerNote tag lookup - debian/patches/CVE-2026-40386.patch: use "i >= n->count" instead of "i > n->count - 1" in exif_mnote_data_fuji_get_value() and exif_mnote_data_olympus_get_value(), which underflowed when count was 0. - CVE-2026-40386