diff --git a/0003-CVE-2026-39979.patch b/0003-CVE-2026-39979.patch
new file mode 100644
index 0000000..e2692d6
--- /dev/null
+++ b/0003-CVE-2026-39979.patch
@@ -0,0 +1,24 @@
+commit 2f09060afab23fe9390cce7cb860b10416e1bf5f
+Author: itchyny <itchyny@cybozu.co.jp>
+Date:   Mon Apr 13 11:04:52 2026 +0900
+
+    Fix out-of-bounds read in jv_parse_sized()
+    
+    This fixes CVE-2026-39979.
+    
+    Co-authored-by: Mattias Wadman <mattias.wadman@gmail.com>
+
+diff -up jq-jq-1.7.1/src/jv_parse.c.orig jq-jq-1.7.1/src/jv_parse.c
+--- jq-jq-1.7.1/src/jv_parse.c.orig	2023-12-13 20:20:22.000000000 +0100
++++ jq-jq-1.7.1/src/jv_parse.c	2026-04-24 09:38:10.259656776 +0200
+@@ -890,8 +890,9 @@ jv jv_parse_sized_custom_flags(const cha
+ 
+   if (!jv_is_valid(value) && jv_invalid_has_msg(jv_copy(value))) {
+     jv msg = jv_invalid_get_msg(value);
+-    value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%s')",
++    value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%.*s')",
+                                               jv_string_value(msg),
++                                              length,
+                                               string));
+     jv_free(msg);
+   }
diff --git a/jq.spec b/jq.spec
index 463de96..06b45ba 100644
--- a/jq.spec
+++ b/jq.spec
@@ -11,7 +11,8 @@ License:        MIT and ASL 2.0 and CC-BY and GPLv3
 URL:            https://jqlang.github.io/jq/
 Source0:        https://github.com/jqlang/jq/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
 Patch1:         0001-CVE-2024-23337.patch
-Patch3:         0002-CVE-2025-48060.patch
+Patch2:         0002-CVE-2025-48060.patch
+Patch3:         0003-CVE-2026-39979.patch
 
 BuildRequires:  gcc
 BuildRequires:  flex