diff --git a/deepin-reader-5.9.9.2.tar.gz b/deepin-reader-5.9.9.2.tar.gz
deleted file mode 100644
index ac32c6532cfb9118cd56f2d8568304445e28e62f..0000000000000000000000000000000000000000
Binary files a/deepin-reader-5.9.9.2.tar.gz and /dev/null differ
diff --git a/deepin-reader-6.0.7.tar.gz b/deepin-reader-6.0.7.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..a55bba1f3ed4108f5ce2285f6849126033a7cdd8
Binary files /dev/null and b/deepin-reader-6.0.7.tar.gz differ
diff --git a/deepin-reader.spec b/deepin-reader.spec
index c2cb4ad72425db8539a1117cafd1baeec74ba7f2..ddeee747a884db1fde66f1dd6f29563e458f9912 100644
--- a/deepin-reader.spec
+++ b/deepin-reader.spec
@@ -5,8 +5,8 @@
 %global debug_package   %{nil}
 
 Name:           deepin-reader
-Version:        5.9.9.2
-Release:        2.%{anolis_release}%{?dist}
+Version:        6.0.7
+Release:        %{anolis_release}%{?dist}
 Summary:        A simple PDF reader, supporting bookmarks, highlights and annotations
 License:        GPLv3+
 URL:            https://github.com/linuxdeepin/%{name}
@@ -31,6 +31,9 @@ BuildRequires: nspr-devel
 BuildRequires: fontconfig-devel
 BuildRequires: lcms2-devel
 BuildRequires: libX11-devel
+BuildRequires: libchardet-devel
+BuildRequires: qt5-qtwebengine
+BuildRequires: libvpx
 # BuildRequires: libicu-devel
 # BuildRequires: libpng-devel
 # BuildRequires: zlib-devel
@@ -68,6 +71,9 @@ popd
 /usr/lib/deepin-reader/libdeepin-poppler*
 
 %changelog
+* Tue Jun 10 2025 Cheng Yang <yc02267530@alibaba-inc.com> - 6.0.7-1
+- update to 6.0.7 to fix CVE-2023-50254
+
 * Tue Jan 09 2024 yangxianzhao <yangxianzhao@uniontech.com> - 5.9.9.2-2.1
 - fix build error