diff --git a/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch b/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
new file mode 100644
index 0000000..d6c2bc4
--- /dev/null
+++ b/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
@@ -0,0 +1,107 @@
+From 88eb53d12c19f16ce9b3b6b8766084effcadfc1a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= <tim@centricular.com>
+Date: Sun, 8 Feb 2026 16:01:21 +0000
+Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element
+
+Forbid use of this element and comment out all processing code.
+
+There is no plausible reason this code should ever be executed in 2026
+seeing that this was a streaming format produced by Darwin Streaming Server
+ca 2009 which hasn't been in active use for well over a decade.
+
+We simply error out for now as defensive measure and will remove the
+element entirely in the next release cycle.
+
+The processing functions are hairy and rather tedious to fix without
+at least some sample stream at hand.
+
+If anyone actually does have a legitimate need for this element and
+can provide a sample streams, we will happily implement a depayloader
+in Rust.
+
+Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10886>
+---
+ .../gst-plugins-good/gst/rtp/gstrtpqdmdepay.c | 25 ++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
+index 3edfb46301..1d69fc2e1c 100644
+--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
+@@ -57,11 +57,13 @@ G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay,
+ GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (rtpqdm2depay, "rtpqdm2depay",
+     GST_RANK_SECONDARY, GST_TYPE_RTP_QDM2_DEPAY, _do_init);
+ 
++#if 0
+ static const guint8 headheader[20] = {
+   0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61,
+   0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24,
+   0x51, 0x44, 0x43, 0x41
+ };
++#endif
+ 
+ static void gst_rtp_qdm2_depay_finalize (GObject * object);
+ 
+@@ -138,6 +140,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps)
+   return TRUE;
+ }
+ 
++#if 0
+ static void
+ flush_data (GstRtpQDM2Depay * depay)
+ {
+@@ -230,10 +233,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data)
+   memcpy (packet->data + packet->offs, data, len);
+   packet->offs += len;
+ }
++#endif
+ 
+ static GstBuffer *
+ gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
+ {
++  /* There is no plausible reason this code should ever be executed in 2026
++   * seeing that this was a streaming format produced by Darwin Streaming Server
++   * ca 2009 which hasn't been in active use for well over a decade.
++   *
++   * We simply return here as defensive measure.
++   *
++   * We post an error message in the state change function, so this processing
++   * function should never be reached, we just ifdef the code out for clarity.
++   *
++   * If anyone actually does have a legitimate need for this and can provide
++   * sample streams, we will happily implement a depayloader in Rust.
++   */
++  return NULL;
++
++#if 0
+   GstRtpQDM2Depay *rtpqdm2depay;
+   GstBuffer *outbuf = NULL;
+   guint16 seq;
+@@ -378,6 +397,7 @@ bad_packet:
+         (NULL), ("Packet was too short"));
+     return NULL;
+   }
++#endif
+ }
+ 
+ static GstStateChangeReturn
+@@ -391,7 +411,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element,
+ 
+   switch (transition) {
+     case GST_STATE_CHANGE_NULL_TO_READY:
+-      break;
++      GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE,
++          ("This element should not be used."),
++          ("Please report an issue if you encounter this message."));
++      return GST_STATE_CHANGE_FAILURE;
+     case GST_STATE_CHANGE_READY_TO_PAUSED:
+       gst_adapter_clear (rtpqdm2depay->adapter);
+       break;
+-- 
+2.53.0
+
diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec
index 8124238..1bed36e 100644
--- a/gstreamer1-plugins-good.spec
+++ b/gstreamer1-plugins-good.spec
@@ -35,7 +35,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.26.7
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        GStreamer plugins with good code and licensing
 
 License:        CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 
@@ -55,6 +55,8 @@ Source0:        http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugin
 # See http://www.freedesktop.org/software/appstream/docs/ for more details.
 Source1:        gstreamer-good.appdata.xml
 
+Patch:		0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
+
 BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
@@ -215,7 +217,8 @@ to be installed.
 
 
 %prep
-%setup -q -n gst-plugins-good-%{version}
+%autosetup -n gst-plugins-good-%{version} -p3
+
 
 %build
 %meson \
@@ -373,6 +376,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
 
 
 %changelog
+* Tue Mar 31 2026 Wim Taymans <wtaymans@redhat.com> - 1.26.7-2
+- Add patch for CVE-2026-3083 and CVE-2026-3085
+  Resolves: RHEL-156142, RHEL-156119
+
 * Tue Nov 04 2025 Wim Taymans <wtaymans@redhat.com> - 1.26.7-1
 - Update to 1.26.7
   Resolves: RHEL-126057