- CVE-2026-86138: add overflow checks to xmlDictAddQString to prevent an integer overflow and heap buffer overflow - CVE-2026-86140: bound the writes in xmlSnprintfElements to prevent a stack buffer overflow - CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated length in xmlXPtrEvalXPtrPart to prevent a heap buffer overflow - CVE-2026-86143: reject buffer lengths at or above INT_MAX before calling the output write callback to prevent an integer overflow - CVE-2026-86144: propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree so parser flags such as XML_PARSE_NONET are honoured