diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
new file mode 100644
index 0000000000..a02268bf11
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
@@ -0,0 +1,74 @@
+From a927a964d462e9966864b7b2c432942b61038d6b Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Mon, 13 Jul 2026 09:27:02 +0700
+Subject: [PATCH] Merge commit from fork
+
+The AVI player used a chunk length taken from the input file as the
+number of bytes to read into the video frame buffer, whose capacity is
+derived from the (also file-supplied) declared dimensions, without
+reconciling the two. A crafted file could therefore cause a write past
+the end of the buffer. The only guard was an assertion, which is a
+no-op in release builds.
+
+Clamp the read to the frame buffer capacity, skip any remaining chunk
+bytes so the file position stays aligned, and remove the reliance on
+the assertion for validating a file-supplied length.
+
+Ref: GHSA-6p2p-5wf8-h5hr
+(cherry picked from commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f)
+
+CVE: CVE-2026-77396
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/avi_player.c | 34 +++++++++++++++++++++++++++++---
+ 1 file changed, 31 insertions(+), 3 deletions(-)
+
+diff --git a/pjmedia/src/pjmedia/avi_player.c b/pjmedia/src/pjmedia/avi_player.c
+index dc87b8a41..8b4b94d16 100644
+--- a/pjmedia/src/pjmedia/avi_player.c
++++ b/pjmedia/src/pjmedia/avi_player.c
+@@ -1199,12 +1199,40 @@ static pj_status_t avi_get_frame(pjmedia_port *this_port,
+                 goto on_error2;
+             fport->size_left -= size_to_read;
+         } else {
+-            pj_assert(frame->size >= ch.len);
+-            status = file_read3(fport->fd, frame->buf, ch.len,
++            pj_uint32_t read_len = ch.len;
++
++            /* Clamp the read to the frame buffer capacity. A crafted
++             * file may declare a chunk larger than the buffer, whose
++             * size is derived from the (also file-supplied) video
++             * dimensions; never write past frame->buf (frame->size
++             * bytes). Do not rely on pj_assert() here, as it is a no-op
++             * in release builds.
++             */
++            if (read_len > frame->size) {
++                PJ_LOG(3, (THIS_FILE,
++                           "AVI video chunk (%u) exceeds frame buffer "
++                           "(%u), truncating",
++                           (unsigned)ch.len, (unsigned)frame->size));
++                read_len = (pj_uint32_t)frame->size;
++            }
++
++            status = file_read3(fport->fd, frame->buf, read_len,
+                                 0, &size_read);
+             if (status != PJ_SUCCESS)
+                 goto on_error2;
+-            frame->size = ch.len;
++
++            /* Skip any remaining chunk bytes that did not fit, so the
++             * file position stays aligned to the next chunk.
++             */
++            if (ch.len > read_len) {
++                status = pj_file_setpos(fport->fd,
++                                        (pj_off_t)ch.len - read_len,
++                                        PJ_SEEK_CUR);
++                if (status != PJ_SUCCESS)
++                    goto on_error2;
++            }
++
++            frame->size = read_len;
+             fport->size_left = 0;
+         }
+ 
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 9d1e6af253..89763b3011 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57164.patch \
            file://CVE-2026-57165.patch \
            file://CVE-2026-57166.patch \
+           file://CVE-2026-77396.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"