diff --git a/gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch b/gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch
new file mode 100644
index 0000000..aac1f3c
--- /dev/null
+++ b/gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch
@@ -0,0 +1,66 @@
+From 6f1894e23e665cb538051f301a6318850e601c5a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 19 Jun 2026 13:20:04 +0300
+Subject: [PATCH] gdkpixbufdec: Handle format and resolution changes correctly
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
+---
+ ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
+index c0ecb3a..4472e79 100644
+--- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
++++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
+@@ -289,6 +289,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
+   gint width, height;
+   gint n_channels;
+   GstVideoFrame frame;
++  GstVideoFormat fmt;
+ 
+   pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader);
+   if (pixbuf == NULL)
+@@ -297,26 +298,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
+   width = gdk_pixbuf_get_width (pixbuf);
+   height = gdk_pixbuf_get_height (pixbuf);
+ 
+-  if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) {
++  n_channels = gdk_pixbuf_get_n_channels (pixbuf);
++  switch (n_channels) {
++    case 3:
++      fmt = GST_VIDEO_FORMAT_RGB;
++      break;
++    case 4:
++      fmt = GST_VIDEO_FORMAT_RGBA;
++      break;
++    default:
++      goto channels_not_supported;
++  }
++
++  if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt ||
++      GST_VIDEO_INFO_WIDTH (&filter->info) != width ||
++      GST_VIDEO_INFO_HEIGHT (&filter->info) != height) {
+     GstVideoInfo info;
+-    GstVideoFormat fmt;
+     GList *l;
+ 
+     GST_DEBUG ("Set size to %dx%d", width, height);
+ 
+-    n_channels = gdk_pixbuf_get_n_channels (pixbuf);
+-    switch (n_channels) {
+-      case 3:
+-        fmt = GST_VIDEO_FORMAT_RGB;
+-        break;
+-      case 4:
+-        fmt = GST_VIDEO_FORMAT_RGBA;
+-        break;
+-      default:
+-        goto channels_not_supported;
+-    }
+-
+-
+     gst_video_info_init (&info);
+     if (!gst_video_info_set_format (&info, fmt, width, height))
+       goto format_not_supported;
diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec
index 643e1e5..6a320f9 100644
--- a/gstreamer1-plugins-good.spec
+++ b/gstreamer1-plugins-good.spec
@@ -15,7 +15,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.16.1
-Release:        7%{?gitcommit:.git%{shortcommit}}%{?dist}.5
+Release:        7%{?gitcommit:.git%{shortcommit}}%{?dist}.6
 Summary:        GStreamer plugins with good code and licensing
 
 License:        LGPLv2+
@@ -57,6 +57,9 @@ Patch14:        gstreamer1-plugins-good-1.16.1-CVE-2026-18296.patch
 # https://issues.redhat.com/browse/RHEL-246618
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042
 Patch15:        gstreamer1-plugins-good-1.16.1-CVE-2026-18299.patch
+# https://issues.redhat.com/browse/RHEL-246561
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/cf4f7cbc081cde7769862b424c105f10c083171b
+Patch16:        gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch
 
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
@@ -206,6 +209,7 @@ to be installed.
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
+%patch16 -p1
 
 %build
 %configure --disable-silent-rules --disable-fatal-warnings \
@@ -390,6 +394,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 
 %changelog
+* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.6
+- Fix CVE-2026-18298: heap buffer overflow in GdkPixbuf image decoder
+  Resolves: RHEL-246561
+
 * Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.5
 - Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay
   Resolves: RHEL-246618