diff --git a/SOURCES/gimp-CVE-2026-58380.patch b/SOURCES/gimp-CVE-2026-58380.patch
new file mode 100644
index 0000000..f5d36aa
--- /dev/null
+++ b/SOURCES/gimp-CVE-2026-58380.patch
@@ -0,0 +1,28 @@
+From e5dcc36627ed4b19d12a70dc12f0f9eb51ae56ce Mon Sep 17 00:00:00 2001
+From: Alx Sa <cmyk.student@gmail.com>
+Date: Sat, 11 Apr 2026 14:33:42 +0000
+Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken
+
+Resolves #16206
+pnmscanner_gettoken () in file-pnm assumes that the
+buffer it receives is larger than its bufsize parameter.
+In almost all cases this is true, except in pnm_load_ascii ().
+This patch adds the + 4 that is used everywhere else to ensure
+we don't have an issue with buffer overflow.
+---
+ plug-ins/common/file-pnm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
+index 65619be59d..81d73c1450 100644
+--- a/plug-ins/common/file-pnm.c
++++ b/plug-ins/common/file-pnm.c
+@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan,
+   gint      x, y, i, b;
+   gint      start, end, scanlines;
+   gint      np;
+-  gchar     buf[BUFLEN];
++  gchar     buf[BUFLEN + 4];
+   gboolean  aborted = FALSE;
+ 
+   np = (info->np) ? (info->np) : 1;
diff --git a/SOURCES/gimp-CVE-2026-58384.patch b/SOURCES/gimp-CVE-2026-58384.patch
new file mode 100644
index 0000000..a4239bb
--- /dev/null
+++ b/SOURCES/gimp-CVE-2026-58384.patch
@@ -0,0 +1,46 @@
+From 0fd8931dcccbd055caefe242d9cf8f86073d2835 Mon Sep 17 00:00:00 2001
+From: Alx Sa <cmyk.student@gmail.com>
+Date: Sat, 11 Apr 2026 17:41:50 +0000
+Subject: [PATCH] plug-ins: Guard against too large PSD channel sizes
+
+Resolves #16216
+If a PSD channel row size is intentionally set very high, multiplying
+it by 4 in our code can cause an overflow and wraparound to a lower
+value for memory allocation.
+This patch adds checks to prevent this if the total size exceeds
+G_MAXUINT32.
+---
+ plug-ins/file-psd/psd-load.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/plug-ins/file-psd/psd-load.c b/plug-ins/file-psd/psd-load.c
+index 676f3da9b4..64e9a5d9a2 100644
+--- a/plug-ins/file-psd/psd-load.c
++++ b/plug-ins/file-psd/psd-load.c
+@@ -1790,6 +1790,7 @@ read_RLE_channel (PSDimage      *img_a,
+ {
+   gint      rle_count_size = (img_a->version == 1 ? 2 : 4);
+   gint      rle_row_size   = lyr_chn->rows * rle_count_size;
++  gsize     row_allocation;
+   guint32  *rle_pack_len;
+   gint      rowi;
+ 
+@@ -1799,7 +1800,17 @@ read_RLE_channel (PSDimage      *img_a,
+                     channel_data_len - 2,
+                     rle_row_size,
+                     (channel_data_len - 2 - rle_row_size));
+-  rle_pack_len = g_malloc (lyr_chn->rows * 4); /* Always 4 since this is the data size in memory. */
++
++  /* Always 4 since this is the data size in memory. */
++  if (! g_size_checked_mul (&row_allocation, lyr_chn->rows, 4) ||
++      row_allocation >= G_MAXUINT32)
++    {
++      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
++                   _("Unsupported or invalid channel size"));
++      return FALSE;
++    }
++
++  rle_pack_len = g_malloc ((guint32) row_allocation);
+   for (rowi = 0; rowi < lyr_chn->rows; ++rowi)
+     {
+       if (psd_read (input, &rle_pack_len[rowi], rle_count_size,
diff --git a/SPECS/gimp.spec b/SPECS/gimp.spec
index cde615d..1d60f77 100644
--- a/SPECS/gimp.spec
+++ b/SPECS/gimp.spec
@@ -67,7 +67,7 @@ Name:           gimp
 Epoch:          2
 Version:        3.0.4
 %global rel     4
-Release:        %{rel}%{?dist}.5
+Release:        %{rel}%{?dist}.7
 # https://bugzilla.redhat.com/show_bug.cgi?id=2318369
 ExcludeArch:    s390x
 
@@ -273,6 +273,10 @@ Patch19:        gimp-CVE-2026-4154.patch
 Patch20:        gimp-CVE-2026-4887.patch
 # https://github.com/GNOME/gimp/commit/b630f167ba7b73b17e7dd6df1fee1623f8324575
 Patch21:        gimp-CVE-2026-58379.patch
+# https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217
+Patch22:        gimp-CVE-2026-58384.patch
+# https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817
+Patch23:        gimp-CVE-2026-58380.patch
 
 # use external help browser directly if help browser plug-in is not built
 Patch100:       gimp-3.0.2-external-help-browser.patch
@@ -366,6 +370,8 @@ EOF
 %patch19 -p1 -b .CVE-2026-4154
 %patch20 -p1 -b .CVE-2026-4887
 %patch21 -p1 -b .CVE-2026-58379
+%patch22 -p1 -b .CVE-2026-58384
+%patch23 -p1 -b .CVE-2026-58380
 
 %patch100 -p1 -b .external-help-browser
 
@@ -681,6 +687,10 @@ done
 %endif
 
 %changelog
+* Fri Jul 10 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.6
+- fix CVE-2026-58384
+- Resolves: RHEL-192536
+
 * Sat Jul 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.5
 - fix CVE-2026-58379
 - Resolves: RHEL-192170