Integer overflow on .BMP parsing, double free() on GIF parsing, new ms-its: vulnerability variant.
vulners.com/securityvulns/securityvulns:doc:6558
vulners.com/securityvulns/securityvulns:doc:6559