diff --git a/NEWS b/NEWS
index ab0e5cf25a4..addf7f5ada5 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,8 @@ PHP                                                                        NEWS
 - Fileinfo:
   . Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal
     string size). (Francisco Alonso, Remi)
+  . Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary
+    check). (Francisco Alonso, Remi)
 
 - OpenSSL:
   . Fixed bug #65698 (certificates validity parsing does not work past 2050).