diff --git a/editorconfig.spec b/editorconfig.spec
index 228a0971359e53749ee08e118f758df9f800c151..b6ed1f7b8fdf1fa1532c9d4b359568b4cd2b4fa7 100644
--- a/editorconfig.spec
+++ b/editorconfig.spec
@@ -5,10 +5,11 @@
 Name:           editorconfig
 Summary:        Parser for EditorConfig files written in C
 Version:        0.12.6
-Release:        1
+Release:        2
 License:        BSD
 URL:            https://github.com/editorconfig/editorconfig-core-c
 Source0:        %{url}/archive/v%{version}/%{srcname}-%{version}.tar.gz
+Patch0:         CVE-2024-53849.patch
 
 BuildRequires:  cmake doxygen gcc pcre2-devel
 
@@ -79,6 +80,9 @@ rm %{buildroot}/%{_libdir}/libeditorconfig_static.a
 
 
 %changelog
+* Mon Jun 16 2025 lvfei <lvfei@kylinos.cn> - 0.12.6-2
+- fix CVE-2024-53849
+
 * Thu Nov 23 2023 zhangxianting <zhangxianting@uniontech.com> - 0.12.6-1
 - update to version 0.12.6