diff --git a/gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch b/gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
new file mode 100644
index 0000000..a7005a8
--- /dev/null
+++ b/gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
@@ -0,0 +1,97 @@
+From e4aeed10953ee9ca359a256036e3f1f6151dbdb0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 13 Mar 2026 11:56:45 +0200
+Subject: [PATCH] qtdemux: Add various integer overflow and bounds checks to
+ uncompressed video handling
+
+Fixes ZDI-CAN-29392
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4963
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242>
+---
+ .../gst-plugins-good/gst/isomp4/qtdemux.c     | 37 ++++++++++++++++---
+ 1 file changed, 32 insertions(+), 5 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index b5669275f6..92c61787f2 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -12121,6 +12121,14 @@ qtdemux_parse_cmpd (GstQTDemux * qtdemux, GstByteReader * reader,
+ 
+   cmpd->component_count = gst_byte_reader_get_uint32_be_unchecked (reader);
+ 
++  /* Let's use 16 as a upper bound here for now to avoid overflows and
++   * allocating lots of memory */
++  if (cmpd->component_count > 16) {
++    GST_ERROR_OBJECT (qtdemux, "Unsupported number of cmpd components %u",
++        cmpd->component_count);
++    goto error;
++  }
++
+   guint32 minimum_size = cmpd->component_count * 2 + 4; // assuming type_uris are not used
+   if (gst_byte_reader_get_size (reader) < minimum_size) {
+     GST_ERROR_OBJECT (qtdemux, "cmpd size is too short");
+@@ -12179,6 +12187,14 @@ qtdemux_parse_uncC (GstQTDemux * qtdemux, GstByteReader * reader,
+     goto error;
+   }
+ 
++  /* Let's use 16 as a upper bound here for now to avoid overflows and
++   * allocating lots of memory */
++  if (uncC->component_count > 16) {
++    GST_ERROR_OBJECT (qtdemux, "Unsupported number of uncC components %u",
++        uncC->component_count);
++    goto error;
++  }
++
+   guint32 expected_size = uncC->component_count * 5 + 36;
+   if (gst_byte_reader_get_size (reader) != expected_size) {
+     GST_ERROR_OBJECT (qtdemux, "uncC size is incorrect");
+@@ -12432,7 +12448,6 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
+   guint32 num_components = uncC->component_count;
+   guint16 component_types[4];
+ 
+-
+   if (uncC->version == 1) {
+     // Determine format with profile
+     // The only permitted profiles for version 1 are `rgb3`, `rgba`, and `abgr`
+@@ -12460,6 +12475,11 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
+     goto unsupported_feature;
+   }
+ 
++  if (num_components > 4 || num_components == 0) {
++    GST_WARNING_OBJECT (qtdemux,
++        "Unsupported number of components for uncC: %u", num_components);
++    goto unsupported_feature;
++  }
+ 
+   /* Assert that components are similar */
+   UncompressedFrameConfigComponent *first_comp = &uncC->components[0];
+@@ -12501,6 +12521,11 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
+   // Get Component Types
+   for (guint32 i = 0; i < num_components; i++) {
+     guint16 component_index = uncC->components[i].index;
++    if (component_index >= cmpd->component_count) {
++      GST_WARNING_OBJECT (qtdemux,
++          "Invalid component index %u for component %u", component_index, i);
++      goto unsupported_feature;
++    }
+     component_types[i] = cmpd->types[component_index];
+   }
+ 
+@@ -18919,10 +18944,12 @@ qtdemux_video_caps (GstQTDemux * qtdemux, QtDemuxStream * stream,
+       }
+ 
+       format = qtdemux_get_format_from_uncv (qtdemux, &uncC, &cmpd);
+-      gst_video_info_set_format (&stream->pre_info, format, entry->width,
+-          entry->height);
+-      qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
+-      stream->alignment = 32;
++      if (format != GST_VIDEO_FORMAT_UNKNOWN) {
++        gst_video_info_set_format (&stream->pre_info, format, entry->width,
++            entry->height);
++        qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
++        stream->alignment = 32;
++      }
+ 
+       /* Free Memory */
+       qtdemux_clear_uncC (&uncC);
diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec
index eb1835b..f82cd44 100644
--- a/gstreamer1-plugins-good.spec
+++ b/gstreamer1-plugins-good.spec
@@ -35,7 +35,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.26.7
-Release:        2%{?dist}.1
+Release:        2%{?dist}.2
 Summary:        GStreamer plugins with good code and licensing
 
 License:        CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 
@@ -61,6 +61,8 @@ Patch:		0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
 # https://github.com/GStreamer/gstreamer/commit/f2313c0bcc1f68054168e0b6e884d458fba76fbc
 # https://github.com/GStreamer/gstreamer/commit/e92726ba1b60c16487d7a0fe11198f41e3bad51c
 Patch:		gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242
+Patch:		gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
 
 BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc
@@ -381,6 +383,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
 
 
 %changelog
+* Fri Jul 31 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.2
+- Fix integer overflow and bounds check vulnerabilities in uncompressed
+  video handling (CVE-2026-5056)
+  Resolves: RHEL-222333
+
 * Fri Jun 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.1
 - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705)
   Resolves: RHEL-184480