Petr Gajdos

CVE-2026-33535

Thanks!

Eh yes, the main part of the patch seems to be in MNG code, or at least this CVE probably refers just to the last hunk, indeed. I was misled by the first two hunks, sorry for that. I currently do not have any testcase, so this is just theoretical. Could it be that code may run out of space in chunk[] around Write MNG PLTE chunk? unsigned char chunk[800]; [...] if (!need_local_plte && image->storage_class == PseudoClass && !all_images_are_gray) { unsigned long data_length; /* Write MNG PLTE chunk...

Thanks for both fixes (including the grammar one ;)).

CVE-2026-30883

CVE-2026-28690

CVE-2026-25799

fails with poppler 25.10