- CVE-2026-67291: fix heap out-of-bounds read in update_process_glyph_fragments; reject a GLYPH_FRAGMENT_ADD update whose one-byte server-declared fragment size exceeds the bytes remaining in the received order buffer, instead of passing it straight to glyph_cache_fragment_put which copies that many bytes - CVE-2026-67288: fix NULL pointer dereference in the smartcard cache handlers; card_id_and_name_a now rejects NULL CardIdentifier/LookupName instead of calling strlen on them, and PCSC_SCardReadCacheA/W skip the cache lookup and initialise data, so a NULL NDR LookupName pointer in SCARD_IOCTL_READCACHEA/W can no longer crash the client