diff --git a/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch b/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
new file mode 100644
index 0000000..a9fed51
--- /dev/null
+++ b/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
@@ -0,0 +1,66 @@
+From 4bf12dcb5c2722e35e4a5c4f70a94cb833b72ed6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 14 Jul 2026 12:00:34 +0300
+Subject: [PATCH] avidemux: Make sure enough data is available when parsing
+ FUJIFILM strd
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
+---
+ .../gst-plugins-good/gst/avi/gstavidemux.c    | 23 +++++++++++--------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
+index 0d18a6495c..5d7ed2edd6 100644
+--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
++++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
+@@ -3828,13 +3828,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
+ 
+       ptr += 98;
+       left -= 98;
+-      if (!memcmp (ptr, "FUJIFILM", 8)) {
++      if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) {
+         GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48);
+ 
+         ptr += 10;
+         left -= 10;
+         sub_size = 0;
+-        while (ptr[sub_size] && sub_size < left)
++        while (sub_size < left && ptr[sub_size])
+           sub_size++;
+ 
+         if (avi->globaltags == NULL)
+@@ -3845,21 +3845,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
+         parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr,
+             sub_size);
+ 
+-        while (ptr[sub_size] == '\0' && sub_size < left)
++        while (sub_size < left && ptr[sub_size] == '\0')
+           sub_size++;
+ 
+         ptr += sub_size;
+         left -= sub_size;
+         sub_size = 0;
+-        while (ptr[sub_size] && sub_size < left)
++        while (sub_size < left && ptr[sub_size])
+           sub_size++;
+-        if (ptr[4] == ':')
+-          ptr[4] = '-';
+-        if (ptr[7] == ':')
+-          ptr[7] = '-';
+ 
+-        parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
+-            sub_size);
++        if (sub_size >= 8) {
++          if (ptr[4] == ':')
++            ptr[4] = '-';
++          if (ptr[7] == ':')
++            ptr[7] = '-';
++
++          parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
++              sub_size);
++        }
+       }
+     }
+   }
diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec
index b08e2fc..1e1d767 100644
--- a/gstreamer1-plugins-good.spec
+++ b/gstreamer1-plugins-good.spec
@@ -28,7 +28,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.22.12
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        GStreamer plugins with good code and licensing
 
 License:        CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 
@@ -83,6 +83,9 @@ Patch0030:	gstreamer1-plugins-good-1.22.12-CVE-2026-53705.patch
 # https://issues.redhat.com/browse/RHEL-224165
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234
 Patch0031:	gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch
+# https://issues.redhat.com/browse/RHEL-239066
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bb8fb5a9bf15fb845863430281e4bf908aec7090
+Patch0032:	gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
 
 BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc
@@ -273,6 +276,7 @@ to be installed.
 %patch -P 0029 -p3
 %patch -P 0030 -p3
 %patch -P 0031 -p3
+%patch -P 0032 -p3
 
 %build
 %meson \
@@ -423,6 +427,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
 
 
 %changelog
+* Mon Aug 17 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-10
+- Fix out-of-bounds reads in AVI FUJIFILM strd parsing
+  (CVE-2026-73433)
+
 * Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-9
 - Limit maximum fragmentation unit size in RTP H264/H265
   depayloaders to prevent excessive memory usage