diff --git a/gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52719.patch b/gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52719.patch
new file mode 100644
index 0000000..8f5c5a6
--- /dev/null
+++ b/gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52719.patch
@@ -0,0 +1,64 @@
+From c2fa8c17a876830025923696b754c4118e1b2ac9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 9 Jun 2026 09:40:41 +0300
+Subject: [PATCH] vajpegdecoder: Validate that enough data is available for the
+ current JPEG segment
+
+gst_jpeg_parse() does not ensure this and relies on the caller to collect enough
+data. All other users of the function are doing this correctly.
+
+Here we can directly error out if not enough data is available as we require
+parsing input.
+
+Patch provided by Junyi Liu, who also reported this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11805>
+---
+ subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
+index 2448c3c..3fccf03 100644
+--- a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
++++ b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
+@@ -370,6 +370,18 @@ _get_marker_name (guint marker)
+ }
+ #endif
+ 
++static gboolean
++jpeg_segment_fits_input (const GstJpegSegment * seg, gsize size)
++{
++  if (seg->size < 0)
++    return FALSE;
++
++  if ((gsize) seg->offset > size)
++    return FALSE;
++
++  return (gsize) seg->size <= size - (gsize) seg->offset;
++}
++
+ static GstFlowReturn
+ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
+     GstVideoCodecFrame * frame)
+@@ -399,6 +411,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
+     if (!gst_jpeg_parse (&seg, map.data, map.size, offset))
+       goto unmap_and_error;
+ 
++    if (!jpeg_segment_fits_input (&seg, map.size))
++      goto unmap_and_error;
++
+     offset = seg.offset + seg.size;
+     marker = seg.marker;
+ 
+@@ -445,6 +460,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
+           if (!gst_jpeg_parse (&seg_scan, map.data, map.size, offset))
+             goto unmap_and_error;
+ 
++          if (!jpeg_segment_fits_input (&seg_scan, map.size))
++            goto unmap_and_error;
++
+           if (seg_scan.marker < GST_JPEG_MARKER_RST_MIN
+               || seg_scan.marker > GST_JPEG_MARKER_RST_MAX)
+             break;
diff --git a/gstreamer1-plugins-bad-free.spec b/gstreamer1-plugins-bad-free.spec
index 12620ab..0c78011 100644
--- a/gstreamer1-plugins-bad-free.spec
+++ b/gstreamer1-plugins-bad-free.spec
@@ -12,7 +12,7 @@
 
 Name:           gstreamer1-plugins-bad-free
 Version:        1.22.12
-Release:        11%{?dist}
+Release:        12%{?dist}
 Summary:        GStreamer streaming media framework "bad" plugins
 
 License:        LGPLv2+ and LGPLv2
@@ -48,6 +48,9 @@ Patch:          gstreamer1-plugins-bad-free-1.22.12-CVE-2026-59692.patch
 # https://issues.redhat.com/browse/RHEL-184423
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6c146775d784bbe91ff7afc6701ba351306282ce
 Patch:          gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52722.patch
+# https://issues.redhat.com/browse/RHEL-184404
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c97cce5f187fa40d389256ce6c6da68f159bb8bd
+Patch:          gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52719.patch
 
 BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc-c++
@@ -792,6 +795,9 @@ rm $RPM_BUILD_ROOT%{_bindir}/playout
 
 
 %changelog
+* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-12
+- Fix CVE-2026-52719: out-of-bounds read in VA JPEG decoder
+
 * Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-11
 - Fix integer overflows in vmnc decoder (CVE-2026-52722)