diff --git a/libtiff-4.6.0-CVE-2026-4775.patch b/libtiff-4.6.0-CVE-2026-4775.patch
new file mode 100644
index 0000000..1c23907
--- /dev/null
+++ b/libtiff-4.6.0-CVE-2026-4775.patch
@@ -0,0 +1,40 @@
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index 4543dddaefd9818494635f3912c8b22f772e6ba9..fa82d09105490cca6720a5dd934c51f19052ebe0 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -2224,7 +2224,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
+     uint32_t *cp1 = cp + w + toskew;
+     uint32_t *cp2 = cp1 + w + toskew;
+     uint32_t *cp3 = cp2 + w + toskew;
+-    int32_t incr = 3 * w + 4 * toskew;
++    const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
+ 
+     (void)y;
+     /* adjust fromskew */
+@@ -2364,7 +2364,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr44tile)
+ DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
+ {
+     uint32_t *cp1 = cp + w + toskew;
+-    int32_t incr = 2 * toskew + w;
++    const tmsize_t incr = 2 * (tmsize_t)toskew + w;
+ 
+     (void)y;
+     fromskew = (fromskew / 4) * (4 * 2 + 2);
+@@ -2522,7 +2522,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
+ DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
+ {
+     uint32_t *cp2;
+-    int32_t incr = 2 * toskew + w;
++    const tmsize_t incr = 2 * (tmsize_t)toskew + w;
+     (void)y;
+     fromskew = (fromskew / 2) * (2 * 2 + 2);
+     cp2 = cp + w + toskew;
+@@ -2625,7 +2625,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
+ DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
+ {
+     uint32_t *cp2;
+-    int32_t incr = 2 * toskew + w;
++    const tmsize_t incr = 2 * (tmsize_t)toskew + w;
+     (void)y;
+     fromskew = (fromskew / 1) * (1 * 2 + 2);
+     cp2 = cp + w + toskew;
diff --git a/libtiff.spec b/libtiff.spec
index 1fdbc73..55996dd 100644
--- a/libtiff.spec
+++ b/libtiff.spec
@@ -1,7 +1,7 @@
 Summary:       Library of functions for manipulating TIFF format image files
 Name:          libtiff
 Version:       4.6.0
-Release:       6%{?dist}.2
+Release:       6%{?dist}.3
 License:       libtiff
 URL:           http://www.simplesystems.org/libtiff/
 
@@ -17,6 +17,9 @@ Patch2:        RHEL-112524.patch
 # from upstream, for <=4.6.0, RHEL-148254
 # https://gitlab.com/libtiff/libtiff/-/merge_requests/546.patch
 Patch3:        libtiff-4.6.0-CVE-2023-52356.patch
+# from upstream, for <= 4.7.1, RHEL-159309
+# https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c
+Patch4:        libtiff-4.6.0-CVE-2026-4775.patch
 
 BuildRequires: gcc, gcc-c++
 BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel liblerc-devel
@@ -71,6 +74,7 @@ image files using the libtiff library.
 %patch -P 1 -p1 -b .CVE-2024-7006
 %patch -P 2 -p1 -b .RHEL-112524
 %patch -P 3 -p1 -b .CVE-2023-52356
+%patch -P 4 -p1 -b .CVE-2026-4775
 
 # Use build system's libtool.m4, not the one in the package.
 rm -f libtool.m4
@@ -169,6 +173,9 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH make check
 %{_mandir}/man1/*
 
 %changelog
+* Mon Apr 20 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-6.3
+- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159309)
+
 * Wed Mar 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-6.2
 - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148254)