diff --git a/0005-av1parser-Fix-bytes-bits-confusion-when-parsing-tile.patch b/0005-av1parser-Fix-bytes-bits-confusion-when-parsing-tile.patch
new file mode 100644
index 0000000..bde563a
--- /dev/null
+++ b/0005-av1parser-Fix-bytes-bits-confusion-when-parsing-tile.patch
@@ -0,0 +1,41 @@
+From 83b1767d40098f955e166e29b27b7047354e5661 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 9 Jun 2026 09:26:38 +0300
+Subject: [PATCH] av1parser: Fix bytes/bits confusion when parsing tile data
+ size
+
+Which would then later lead to an assertion.
+
+Patch provided by Junyi Liu, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11829>
+---
+ .../gst-libs/gst/codecparsers/gstav1parser.c                | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
+index e2caf91c2d..cf2d860760 100644
+--- a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
++++ b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
+@@ -4339,6 +4339,8 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser,
+   }
+ 
+   for (tile = 0; tile <= tile_list->tile_count_minus_1; tile++) {
++    guint32 tile_data_size;
++
+     if (AV1_REMAINING_BITS (br) < 8 + 8 + 8 + 16) {
+       retval = GST_AV1_PARSER_NO_MORE_DATA;
+       goto error;
+@@ -4353,8 +4355,8 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser,
+     tile_list->entry[tile].coded_tile_data =
+         obu->data + gst_bit_reader_get_pos (br) / 8;
+     /* skip the coded_tile_data */
+-    if (!gst_bit_reader_skip (br,
+-            tile_list->entry[tile].tile_data_size_minus_1 + 1)) {
++    tile_data_size = tile_list->entry[tile].tile_data_size_minus_1 + 1;
++    if (!gst_bit_reader_skip (br, tile_data_size * 8)) {
+       retval = GST_AV1_PARSER_NO_MORE_DATA;
+       goto error;
+     }
diff --git a/gstreamer1-plugins-bad-free.spec b/gstreamer1-plugins-bad-free.spec
index a896815..4e28e14 100644
--- a/gstreamer1-plugins-bad-free.spec
+++ b/gstreamer1-plugins-bad-free.spec
@@ -26,7 +26,7 @@
 
 Name:           gstreamer1-plugins-bad-free
 Version:        1.26.7
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        GStreamer streaming media framework "bad" plugins
 
 License:        LGPLv2+ and LGPLv2
@@ -58,6 +58,8 @@ Patch:          0005-dtlsconnection-Allocate-large-enough-buffer-for-the-.patch
 Patch:          gstreamer1-plugins-bad-free-1.26.7-CVE-2026-52722.patch
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c97cce5f187fa40d389256ce6c6da68f159bb8bd
 Patch:          gstreamer1-plugins-bad-free-1.26.7-CVE-2026-52719.patch
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11829
+Patch:          0005-av1parser-Fix-bytes-bits-confusion-when-parsing-tile.patch
 
 BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc-c++
@@ -885,6 +887,10 @@ EOF
 
 
 %changelog
+* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-8
+- Fix bytes/bits confusion in AV1 parser when parsing tile data size
+  Resolves: RHEL-184392
+
 * Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-7
 - Fix CVE-2026-52719: out-of-bounds read in VA JPEG decoder
   Resolves: RHEL-184407