* SECURITY UPDATE: out-of-bounds read in DNS name escape decoding when running against musl libc - debian/patches/CVE-2026-40684.patch: rewrite the escape-decoding loop of string_copy_dnsdomain() to consume one, two or three digits as available instead of blindly indexing s[1], s[2], s[3] and advancing four bytes, and drop the second pointer advance in the non-digit branch so a trailing lone backslash cannot read past the terminating NUL - CVE-2026-40684 * SECURITY UPDATE: heap out-of-bounds write in JSON string expansions - debian/patches/CVE-2026-40685.patch: in dewrap(), only skip a backslash when a non-NUL character follows it, so a value ending in a single trailing backslash can no longer walk past the end of the string and write beyond the destination buffer - CVE-2026-40685 * SECURITY UPDATE: heap read past the end of the input in UTF-8 expansion operators, allowing data exfiltration through an SMTP rejection message - debian/patches/CVE-2026-40686.patch: stop the continuation-byte loop of the GETUTF8INC macro at the terminating NUL, so malformed UTF-8 that declares more continuation bytes than are present no longer reads into adjacent heap - CVE-2026-40686 * SECURITY UPDATE: uninitialised-memory disclosure and static buffer overflows in the SPA (NTLM) authenticator - debian/patches/CVE-2026-40687.patch: zero the output buffer at the top of spa_base64_to_bits() so a short encoded input no longer leaves previous heap contents in the SPA challenge/response flow, and replace the assert() guards in unicodeToString(), strToUnicode() and toString() with explicit length clamping, since assert() compiles away under NDEBUG and leaves an unchecked write past the end of the 1024-byte static buffers; also clamp the length used by the spa_unicode_add_string macro, which states the truncation contract at the call site (spa_bytes_add() already bounds-checks the copy itself) - CVE-2026-40687 * SECURITY UPDATE: directory traversal outside the spool area through mishandled named-queue arguments, leading to privilege escalation - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to both command-line sources of a queue name, -MCG and -q[f][f][l]G, rejecting a name that contains '/', is longer than 32 characters, or collides with one of the reserved spool subdirectories input, db, msglog and scan; mark -MC and every -MCx argument as admin-only and refuse them for a non-admin caller - CVE-2026-66140 * SECURITY UPDATE: .forward privilege escalation caused by expansion of the pipe command under force_command - debian/patches/CVE-2026-66141.patch: stop passing addr->local_part through expand_string() in the $address_pipe special case of a pipe transport that has force_command set, so command text supplied by a local user in a .forward file is only dequoted and split into arguments instead of being evaluated with the transport's privileges - CVE-2026-66141