- CVE-2026-40467: fix use-after-free in do_getline_redir() in io.c (redir_exp dereferenced after being freed) - CVE-2026-40553: fix stack buffer overflow in ftype() in the readdir extension (unbounded path concatenation before stat()) - CVE-2026-40469: fix integer overflow in do_sub() in builtin.c (64-bit overflow check on the result-buffer size prevents heap corruption in sub/gsub/gensub replacement expansion on 32-bit builds)