diff --git a/gstreamer1-plugins-base-1.26.7-CVE-2026-18297.patch b/gstreamer1-plugins-base-1.26.7-CVE-2026-18297.patch
new file mode 100644
index 0000000..e62b55b
--- /dev/null
+++ b/gstreamer1-plugins-base-1.26.7-CVE-2026-18297.patch
@@ -0,0 +1,27 @@
+From e36d176caa3c8a2e3f333734dc3f128ca813f3ab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 19 Jun 2026 13:48:16 +0300
+Subject: [PATCH] opusdec: Don't use any channel positions for >64 channels
+
+We don't support this.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5122
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044>
+---
+ ext/opus/gstopusdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ext/opus/gstopusdec.c b/ext/opus/gstopusdec.c
+index d3f461d..39a3177 100644
+--- a/ext/opus/gstopusdec.c
++++ b/ext/opus/gstopusdec.c
+@@ -359,6 +359,8 @@ gst_opus_dec_negotiate (GstOpusDec * dec, const GstAudioChannelPosition * pos)
+     GST_DEBUG_OBJECT (dec, "Using a default of 2 channels");
+     dec->n_channels = 2;
+     pos = NULL;
++  } else if (dec->n_channels > 64) {
++    pos = NULL;
+   }
+ 
+   if (dec->sample_rate == 0) {
diff --git a/gstreamer1-plugins-base.spec b/gstreamer1-plugins-base.spec
index 71fbb1c..00ab8c3 100644
--- a/gstreamer1-plugins-base.spec
+++ b/gstreamer1-plugins-base.spec
@@ -9,7 +9,7 @@
 
 Name:           gstreamer1-plugins-base
 Version:        1.26.7
-Release:        2%{?dist}
+Release:        2%{?dist}.1
 Summary:        GStreamer streaming media framework base plugins
 
 License:        LGPL-2.1-or-later
@@ -25,6 +25,10 @@ Patch0:         0001-missing-plugins-Remove-the-mpegaudioversion-field.patch
 
 Patch1:         0001-riff-Correctly-check-that-enough-RGB-palette-data-is.patch
 
+# https://issues.redhat.com/browse/RHEL-246574
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/178ae5ac20db75e56d65e4c4bc142bb234387807
+Patch2:         gstreamer1-plugins-base-1.26.7-CVE-2026-18297.patch
+
 BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
@@ -127,6 +131,7 @@ for the GStreamer Base Plugins library.
 %setup -q -n gst-plugins-base-%{version}
 %patch -P 0 -p1
 %patch -P 1 -p3
+%patch -P 2 -p1
 
 %build
 %meson \
@@ -508,9 +513,13 @@ chrpath --delete $RPM_BUILD_ROOT%{_bindir}/gst-play-1.0
 %endif
 
 %changelog
+* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.1
+- Add patch for CVE-2026-18297
+  Resolves: RHEL-246574
+
 * Tue Mar 31 2025 Wim Taymans <wtaymans@redhat.com> - 1.26.7-2
 - Add patch for CVE-2026-2921
-  Resolves: RHEL-156137
+  Resolves: RHEL-156122
 
 * Mon Nov 03 2025 Wim Taymans <wtaymans@redhat.com> - 1.26.7-1
 - Update to 1.26.7