diff --git a/libtiff-4.4.0-cve-2026-12912p1of2.patch b/libtiff-4.4.0-cve-2026-12912p1of2.patch
new file mode 100644
index 0000000..43c37a8
--- /dev/null
+++ b/libtiff-4.4.0-cve-2026-12912p1of2.patch
@@ -0,0 +1,39 @@
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index 8bc1529d7f5e4a20b9e20e637df8e500dd4b0de0..8efd92737bd0954baeec27c7525886cb82fdd39b 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -876,6 +876,19 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
+ 
+ 	llen = sp->stride * td->td_imagewidth;
+ 
++	/* Fix: ABGR with stride=3 expands 3 samples to 4 output bytes per pixel */
++	if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
++	{
++		tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
++		if (occ < required)
++		{
++			TIFFErrorExt(tif->tif_clientdata, module,
++				      "Output buffer too small for PixarLog ABGR data");
++			memset(op, 0, (size_t)occ);
++			return (0);
++		}
++	}
++
+ 	(void) s;
+ 	assert(sp != NULL);
+ 
+@@ -991,7 +1004,13 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
+ 		case PIXARLOGDATAFMT_8BITABGR:
+ 			horizontalAccumulate8abgr(up, llen, sp->stride,
+ 					(unsigned char *)op, sp->ToLinear8);
+-			op += llen * sizeof(unsigned char);
++
++			/* For stride == 3 (RGB), horizontalAccumulate8abgr expands to 4
++			 * bytes/pixel (ABGR) */
++			if (sp->stride == 3)
++				op += (unsigned long)td->td_imagewidth * 4;
++			else
++				op += (unsigned long)llen * sizeof(unsigned char);
+ 			break;
+ 		default:
+ 			TIFFErrorExt(tif->tif_clientdata, module,
diff --git a/libtiff-4.4.0-cve-2026-12912p2of2.patch b/libtiff-4.4.0-cve-2026-12912p2of2.patch
new file mode 100644
index 0000000..1778ab9
--- /dev/null
+++ b/libtiff-4.4.0-cve-2026-12912p2of2.patch
@@ -0,0 +1,57 @@
+From f9bda11bf2fc819b971517582666d56f18b1bc3f Mon Sep 17 00:00:00 2001
+From: waugustus <wangdw.augustus@qq.com>
+Date: Thu, 7 May 2026 12:48:42 +0800
+Subject: [PATCH] pixarlog: complete ABGR bounds check for multi-row strip
+ decoding
+
+---
+ libtiff/tif_pixarlog.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index f35f3fb01..a6f62f18b 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -880,6 +880,12 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
+ 	if (sp->user_datafmt == PIXARLOGDATAFMT_8BITABGR && sp->stride == 3)
+ 	{
+ 		tmsize_t required = (tmsize_t)td->td_imagewidth * 4;
++        tmsize_t max_rows;
++        tmsize_t max_nsamples;
++
++        /*
++         * Ensure at least one expanded output row fits.
++         */
+ 		if (occ < required)
+ 		{
+ 			TIFFErrorExt(tif->tif_clientdata, module,
+@@ -887,6 +893,26 @@ static int PixarLogDecode(TIFF *tif, uint8_t *op, tmsize_t occ, uint16_t s)
+ 			memset(op, 0, (size_t)occ);
+ 			return (0);
+ 		}
++
++        /*
++         * PixarLogDecode() may process multiple rows per call
++         * (e.g. strip decoding). Limit nsamples so the total
++         * output written by the loop below never exceeds occ.
++         */
++        max_rows = occ / required;
++        max_nsamples = max_rows * llen;
++
++        /*
++         * Truncate excess rows to preserve as much decoded data
++         * as possible while avoiding output buffer overflow.
++         */
++        if (nsamples > max_nsamples)
++        {
++            TIFFWarningExt(tif->tif_clientdata, module,
++                            "PixarLog ABGR decode truncated to avoid "
++                            "output buffer overflow");
++            nsamples = max_nsamples;
++        }
+ 	}
+ 
+ 	(void) s;
+-- 
+GitLab
+
diff --git a/libtiff.spec b/libtiff.spec
index 6ba04e6..c0e85f3 100644
--- a/libtiff.spec
+++ b/libtiff.spec
@@ -1,7 +1,7 @@
 Summary:       Library of functions for manipulating TIFF format image files
 Name:          libtiff
 Version:       4.0.9
-Release:       37%{?dist}
+Release:       38%{?dist}
 License:       libtiff
 Group:         System Environment/Libraries
 URL:           http://www.simplesystems.org/libtiff/
@@ -75,6 +75,12 @@ Patch47:       RHEL-120230.patch
 # https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c
 Patch48:       libtiff-4.4.0-CVE-2026-4775.patch
 
+# from upstream, for < 4.7.2, RHEL-189387
+# https://gitlab.com/libtiff/libtiff/-/merge_requests/873
+Patch49:       libtiff-4.4.0-cve-2026-12912p1of2.patch
+# https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f
+Patch50:       libtiff-4.4.0-cve-2026-12912p2of2.patch
+
 BuildRequires: gcc, gcc-c++
 BuildRequires: zlib-devel libjpeg-devel jbigkit-devel
 BuildRequires: libtool automake autoconf pkgconfig
@@ -227,6 +233,9 @@ find html -name 'Makefile*' | xargs rm
 %{_mandir}/man1/*
 
 %changelog
+* Wed Jul 15 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.0.9-38
+- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189371)
+
 * Mon Apr 20 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.0.9-37
 - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159316)