SECURITY ANNOUNCEMENT

CVE-2026-99002

23 October 2026

Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.

Introduced

3.22ac863719e518ae1a8f328849e64ea26a222f079

Fixed releases

6.12.114f6d9c8abdf06a9c7efa799532d66ed8d5a50734c

6.18.5776e5ddd7d9822c8c3492e0f50ba8978e093069ad

6.6.160db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d

7.2.11fcb137f6e7ed769f7ecad84364a33c451371b602

7.321bc51cb89ced74d6645a138cc2f21184bc75094

View source announcement ↗