diff --git a/libpng-1.6-cve-2026-22695.patch b/libpng-1.6-cve-2026-22695.patch
new file mode 100644
index 0000000..9819b2c
--- /dev/null
+++ b/libpng-1.6-cve-2026-22695.patch
@@ -0,0 +1,25 @@
+diff --git a/pngread.c b/pngread.c
+index e3426292b1..9d86b01dc0 100644
+--- a/pngread.c
++++ b/pngread.c
+@@ -3138,9 +3138,11 @@ png_image_read_direct_scaled(png_voidp argument)
+        argument);
+    png_imagep image = display->image;
+    png_structrp png_ptr = image->opaque->png_ptr;
++   png_inforp info_ptr = image->opaque->info_ptr;
+    png_bytep local_row = png_voidcast(png_bytep, display->local_row);
+    png_bytep first_row = png_voidcast(png_bytep, display->first_row);
+    ptrdiff_t row_bytes = display->row_bytes;
++   size_t copy_bytes = png_get_rowbytes(png_ptr, info_ptr);
+    int passes;
+ 
+    /* Handle interlacing. */
+@@ -3170,7 +3172,7 @@ png_image_read_direct_scaled(png_voidp argument)
+          png_read_row(png_ptr, local_row, NULL);
+ 
+          /* Copy from local_row to user buffer. */
+-         memcpy(output_row, local_row, (size_t)row_bytes);
++         memcpy(output_row, local_row, copy_bytes);
+          output_row += row_bytes;
+       }
+    }
diff --git a/libpng-1.6-cve-2026-22801.patch b/libpng-1.6-cve-2026-22801.patch
new file mode 100644
index 0000000..028cd9d
--- /dev/null
+++ b/libpng-1.6-cve-2026-22801.patch
@@ -0,0 +1,38 @@
+diff --git a/pngwrite.c b/pngwrite.c
+index 08066bcc42..a95b846c8e 100644
+@@ -1678,7 +1678,7 @@ png_write_image_16bit(png_voidp argument)
+       }
+ 
+       png_write_row(png_ptr, png_voidcast(png_const_bytep, display->local_row));
+-      input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
++      input_row += display->row_bytes / 2;
+    }
+ 
+    return 1;
+@@ -1804,7 +1804,7 @@ png_write_image_8bit(png_voidp argument)
+ 
+          png_write_row(png_ptr, png_voidcast(png_const_bytep,
+              display->local_row));
+-         input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
++         input_row += display->row_bytes / 2;
+       } /* while y */
+    }
+ 
+@@ -1829,7 +1829,7 @@ png_write_image_8bit(png_voidp argument)
+          }
+ 
+          png_write_row(png_ptr, output_row);
+-         input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
++         input_row += display->row_bytes / 2;
+       }
+    }
+ 
+@@ -2148,7 +2148,7 @@ png_image_write_main(png_voidp argument)
+       ptrdiff_t row_bytes = display->row_stride;
+ 
+       if (linear != 0)
+-         row_bytes *= (sizeof (png_uint_16));
++         row_bytes *= 2;
+ 
+       if (row_bytes < 0)
+          row += (image->height-1) * (-row_bytes);
diff --git a/libpng.spec b/libpng.spec
index 015e918..506213f 100644
--- a/libpng.spec
+++ b/libpng.spec
@@ -4,7 +4,7 @@ Summary:       A library of functions for manipulating PNG image format files
 Name:          libpng
 Epoch:         2
 Version:       1.6.37
-Release:       13%{?dist}
+Release:       14%{?dist}
 License:       zlib
 URL:           http://www.libpng.org/pub/png/
 
@@ -25,6 +25,12 @@ Patch4:        libpng-1.6-CVE-2025-65018_p2of2.patch
 Patch5:        libpng-1.6-CVE-2025-66293_p1of2.patch
 # https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a
 Patch6:        libpng-1.6-CVE-2025-66293_p2of2.patch
+# from upstream, for <1.6.54, RHEL-147356
+# https://github.com/pnggroup/libpng/commit/e4f7ad4ea2
+Patch7:        libpng-1.6-cve-2026-22695.patch
+# from upstream, for <1.6.54, RHEL-149000
+# https://github.com/pnggroup/libpng/commit/cf155de014fc6c5cb199dd681dd5c8fb70429072
+Patch8:        libpng-1.6-cve-2026-22801.patch
 
 BuildRequires: gcc
 BuildRequires: zlib-devel
@@ -82,6 +88,8 @@ cp -p %{SOURCE1} .
 %patch -P 4 -p1 -b .CVE-2025-65018_p2of2
 %patch -P 5 -p1 -b .CVE-2025-66293_p1of2
 %patch -P 6 -p1 -b .CVE-2025-66293_p2of2
+%patch -P 7 -p1 -b .cve-2026-22695
+%patch -P 8 -p1 -b .cve-2026-22801
 
 %build
 autoreconf -vif
@@ -122,6 +130,10 @@ make check
 %{_bindir}/pngfix
 
 %changelog
+* Thu Feb 19 2026 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
+- fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
+- fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)
+
 * Wed Jan 21 2026 Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
 - CVE-2025-64720: buffer overflow (RHEL-131594)
 - CVE-2025-65018: heap buffer overflow (RHEL-131603)