PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader

Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

Out-of-bounds read when a multi-line text view string ends with a carriage return