* SECURITY UPDATE: heap buffer overflow via an integer overflow in the PE rebuilder - debian/patches/CVE-2026-20213.patch: sum rebuilt section sizes in a 64-bit temporary and reject packed section totals or allocations that exceed CLI_MAX_ALLOCATION in libclamav/rebuildpe.c. - CVE-2026-20213 * SECURITY UPDATE: out-of-bounds write via a section loop underflow in the FSG unpacker - debian/patches/CVE-2026-20214.patch: iterate the section loop with t < sectcnt instead of t <= sectcnt - 1, which underflows when sectcnt is zero, in libclamav/pe.c. - CVE-2026-20214 * SECURITY UPDATE: heap buffer overflow via a 7z substream count overflow - debian/patches/CVE-2026-20215.patch: reject archives whose total unpack-stream count would overflow UInt32 before it is accumulated in libclamav/7z/7zIn.c. - CVE-2026-20215 * SECURITY UPDATE: denial of service via unenforced extraction limits in the InstallShield parser - debian/patches/CVE-2026-20216.patch: apply cli_checklimits() to header parsing and to cab extraction output, and guard the output size accumulator against overflow, in libclamav/ishield.c. - CVE-2026-20216 * SECURITY UPDATE: invalid free via incorrect cleanup bitmap tracking in the PESpin unpacker - debian/patches/CVE-2026-20217.patch: shift the bitmap that the cleanup loop tests, not the unrelated bitman variable, in libclamav/spin.c. - CVE-2026-20217 * SECURITY UPDATE: denial of service via size handling errors in the ALZ parser - debian/patches/CVE-2026-20243.patch: harden ALZ size arithmetic, extract stored, bzip2 and deflate members under scan budgets, use bounded flate2 reads and drop the inflate dependency, in libclamav_rust/src/{alz,scanners,util,sys}.rs, libclamav_rust/Cargo.toml, libclamav_rust/build.rs, libclamav/libclamav.map and Cargo.lock. - CVE-2026-20243 * SECURITY UPDATE: out-of-bounds read via integer overflow in the DMG mish size checks on 32-bit platforms - debian/patches/CVE-2026-20244.patch: compute the expected mish block length in a 64-bit integer, keep the XML range check in subtraction form and avoid overflow in the base64 buffer size, in libclamav/dmg.c. - CVE-2026-20244