diff --git a/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch b/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch
new file mode 100644
index 0000000..7ea128d
--- /dev/null
+++ b/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch
@@ -0,0 +1,35 @@
+From b3a928896a6a87897d9f42e2b10088eb0e13e418 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 14 Jul 2026 12:35:12 +0300
+Subject: [PATCH] avidemux: Use correct divisor for calculating available
+ number of vprp field infos
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
+
+NOTE: The functional change in this patch (CVE-2026-73434) was already
+included in the CVE-2026-73433 patch (Patch11). This patch is adapted
+as a no-op for CVE tracking purposes.
+---
+ gst/avi/gstavidemux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
+index 4be47b2..dbe0d88 100644
+--- a/gst/avi/gstavidemux.c
++++ b/gst/avi/gstavidemux.c
+@@ -1822,8 +1822,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
+ 
+   /* size checking */
+   /* calculate fields based on size */
+-  k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+-          field_info)) / sizeof (vprp->field_info[0]);
++  k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
++          field_info)) / sizeof (vprp->field_info[0]);
+   if (vprp->fields > k) {
+     GST_WARNING_OBJECT (element,
+         "vprp header indicated %d fields, only %d available", vprp->fields, k);
+-- 
+2.43.0
+
diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec
index a962775..418cb40 100644
--- a/gstreamer1-plugins-good.spec
+++ b/gstreamer1-plugins-good.spec
@@ -15,7 +15,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.16.1
-Release:        7%{?gitcommit:.git%{shortcommit}}%{?dist}.2
+Release:        7%{?gitcommit:.git%{shortcommit}}%{?dist}.3
 Summary:        GStreamer plugins with good code and licensing
 
 License:        LGPLv2+
@@ -48,6 +48,9 @@ Patch11:        gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch
 # https://issues.redhat.com/browse/RHEL-224145
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244
 Patch12:        gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch
+# https://issues.redhat.com/browse/RHEL-239048
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f
+Patch13:        gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch
 
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
@@ -194,6 +197,7 @@ to be installed.
 %patch10 -p1
 %patch11 -p1
 %patch12 -p1
+%patch13 -p1
 
 %build
 %configure --disable-silent-rules --disable-fatal-warnings \
@@ -378,6 +382,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 
 %changelog
+* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.3
+- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
+  Resolves: RHEL-239048
+
 * Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.2
 - Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders
   Resolves: RHEL-224145