* SECURITY UPDATE: heap buffer overflow in the dictionary string pool via an oversized QName - debian/patches/CVE-2026-86138.patch: compute the pool growth in xmlDictAddQString() with size_t arithmetic and bail out when the requested size is not representable, so a prefix and name together exceeding 2^30 characters no longer wrap the "4 * (namelen + plen + 1)" product down to a few bytes and overflow the pool on the following copy - CVE-2026-86138 * SECURITY UPDATE: heap buffer overflow when evaluating an oversized XPointer expression - debian/patches/CVE-2026-86142.patch: take the length of the remaining XPointer expression with strlen() and reject anything not representable as an int before sizing the buffer in xmlXPtrEvalXPtrPart(). xmlStrlen() counts in a plain int on this branch and wraps for inputs above 2 GiB, and the loop that copies the expression into the buffer performs no capacity check of its own - CVE-2026-86142 * SECURITY UPDATE: negative length passed to output write callbacks - debian/patches/CVE-2026-86143.patch: reject buffer lengths above INT_MAX before narrowing them for the writecallback() argument, in both xmlOutputBufferWrite() and xmlOutputBufferWriteEscape() as well as xmlOutputBufferFlush(). Without this a buffer larger than 2 GiB reaches the callback as a negative int, which callbacks such as xmlFileWrite() convert straight into a huge size_t for fwrite() - CVE-2026-86143 * SECURITY UPDATE: XInclude processing ignored the document parse flags, dropping XML_PARSE_NONET - debian/patches/CVE-2026-86144.patch: pass the document's own parseFlags through xmlXIncludeProcess() and xmlXIncludeProcessTree() instead of hardcoding 0, and apply them to the parser context that xmlXIncludeLoadTxt() builds for parse="text" includes, so a caller that parsed with XML_PARSE_NONET no longer has that restriction silently dropped when XInclude references are resolved, on either the parse="xml" or the parse="text" path, which allowed remote resources to be fetched - CVE-2026-86144