The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 ("Thumbnail
generation decodes unbounded image dimensions before scaling",
patched in v1.30.4) bounds only the width × height of a single frame.
The decoded-size budget is still not enforced over frame count,
so an animated PNG whose per-frame dimensions sit just under the
limit still expands to a multiple of it. A remote, unauthenticated
client can deliver such an attachment over SMTP and then request
one thumbnail to force a multi-gigabyte native allocation.