diff --git a/0007-Fix-CVE-2026-14164.patch b/0007-Fix-CVE-2026-14164.patch
new file mode 100644
index 0000000..b141334
--- /dev/null
+++ b/0007-Fix-CVE-2026-14164.patch
@@ -0,0 +1,22 @@
+# Patch sources from libarchive upstream
+# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
+
+diff -Naur libarchive-3.7.7/libarchive/archive_read_support_format_rar5.c libarchive-3.7.7_patched/libarchive/archive_read_support_format_rar5.c
+--- libarchive-3.7.7/libarchive/archive_read_support_format_rar5.c	2024-10-13 10:11:23.000000000 +0200
++++ libarchive-3.7.7_patched/libarchive/archive_read_support_format_rar5.c	2026-06-30 16:12:48.145167461 +0200
+@@ -2487,12 +2487,12 @@
+ 	free(rar->cstate.window_buf);
+ 	free(rar->cstate.filtered_buf);
+ 
++    rar->cstate.window_buf = NULL;
++    rar->cstate.filtered_buf = NULL;
++
+ 	if(rar->cstate.window_size > 0) {
+ 		rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
+ 		rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
+-	} else {
+-		rar->cstate.window_buf = NULL;
+-		rar->cstate.filtered_buf = NULL;
+ 	}
+ 
+ 	clear_data_ready_stack(rar);
diff --git a/libarchive.spec b/libarchive.spec
index 8b62a75..6b640ed 100644
--- a/libarchive.spec
+++ b/libarchive.spec
@@ -2,7 +2,7 @@
 
 Name:           libarchive
 Version:        3.7.7
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        A library for handling streaming archive formats
 
 # Licenses:
@@ -55,6 +55,8 @@ Patch0005: 0005-Infinite-loop-in-Rar5-decompression.patch
 # Source: https://github.com/libarchive/libarchive/pull/2898/changes/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375
 # and: https://github.com/libarchive/libarchive/pull/2898/changes/e1907c5832b6489c7b4198b0825f857c93a03c10
 Patch0006: 0006-Fix-CVE-2026-4424.patch
+# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
+Patch0007: 0007-Fix-CVE-2026-14164.patch
 
 %description
 Libarchive is a programming library that can create and read several different
@@ -264,6 +266,9 @@ run_testsuite
 
 
 %changelog
+* Tue Jun 30 2026 Pavol Sloboda <psloboda@redhat.com> - 3.7.7-9
+- Resolves: CVE-2026-14164
+
 * Wed Apr 08 2026 Pavol Sloboda <psloboda@redhat.com> - 3.7.7-8
 - Resolves: CVE-2026-4424