diff --git a/libarchive-3.5.3-Fix-CVE-2026-14164.patch b/libarchive-3.5.3-Fix-CVE-2026-14164.patch
new file mode 100644
index 0000000..101574b
--- /dev/null
+++ b/libarchive-3.5.3-Fix-CVE-2026-14164.patch
@@ -0,0 +1,22 @@
+# Patch sources from libarchive upstream
+# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
+
+diff -Naur libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c
+--- libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c	2022-02-08 09:44:39.000000000 +0100
++++ libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c	2026-06-30 15:28:28.055651344 +0200
+@@ -2340,12 +2340,12 @@
+ 	free(rar->cstate.window_buf);
+ 	free(rar->cstate.filtered_buf);
+ 
++    rar->cstate.window_buf = NULL;
++    rar->cstate.filtered_buf = NULL;
++
+ 	if(rar->cstate.window_size > 0) {
+ 		rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
+ 		rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
+-	} else {
+-		rar->cstate.window_buf = NULL;
+-		rar->cstate.filtered_buf = NULL;
+ 	}
+ 
+ 	rar->cstate.write_ptr = 0;
diff --git a/libarchive.spec b/libarchive.spec
index 25695df..887c8f0 100644
--- a/libarchive.spec
+++ b/libarchive.spec
@@ -2,7 +2,7 @@
 
 Name:           libarchive
 Version:        3.5.3
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        A library for handling streaming archive formats
 
 License:        BSD
@@ -27,6 +27,8 @@ Patch7:		%{name}-3.5.3-Fix-CVE-2026-4111.patch
 Patch8:     %{name}-3.5.3-Fix-CVE-2026-4424.patch
 # Source: https://github.com/libarchive/libarchive/pull/2934/changes/889a228b71f2b1fab8dc5610f6c43ac0e9b92160
 Patch9:     %{name}-3.5.3-Fix-CVE-2026-5121.patch
+# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
+Patch10:    %{name}-3.5.3-Fix-CVE-2026-14164.patch
 
 
 BuildRequires:  automake
@@ -234,6 +236,9 @@ run_testsuite
 
 
 %changelog
+* Tue Jun 30 2026 Pavol Sloboda <psloboda@redhat.com> - 3.5.3-10
+- Resolves: CVE-2026-14164
+
 * Thu Apr 09 2026 Pavol Sloboda <psloboda@redhat.com> - 3.5.3-9
 - Resolves: CVE-2026-4424
 - Resolves: CVE-2026-5121