diff --git a/SPECS/oniguruma/CVE-2020-26159.patch b/SPECS/oniguruma/CVE-2020-26159.patch
new file mode 100644
index 00000000000..71a8adadb6b
--- /dev/null
+++ b/SPECS/oniguruma/CVE-2020-26159.patch
@@ -0,0 +1,22 @@
+From cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0 Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kkosako0@gmail.com>
+Date: Mon, 21 Sep 2020 12:58:29 +0900
+Subject: [PATCH] #207: Out-of-bounds write
+
+---
+ src/regcomp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/regcomp.c b/src/regcomp.c
+index f6494b6d..a0a68561 100644
+--- a/src/regcomp.c
++++ b/src/regcomp.c
+@@ -6257,7 +6257,7 @@ concat_opt_exact_str(OptStr* to, UChar* s, UChar* end, OnigEncoding enc)
+ 
+   for (i = to->len, p = s; p < end && i < OPT_EXACT_MAXLEN; ) {
+     len = enclen(enc, p);
+-    if (i + len > OPT_EXACT_MAXLEN) break;
++    if (i + len >= OPT_EXACT_MAXLEN) break;
+     for (j = 0; j < len && p < end; j++)
+       to->s[i++] = *p++;
+   }
diff --git a/SPECS/oniguruma/oniguruma.spec b/SPECS/oniguruma/oniguruma.spec
index 33e4981f8cb..d395818bd64 100644
--- a/SPECS/oniguruma/oniguruma.spec
+++ b/SPECS/oniguruma/oniguruma.spec
@@ -1,6 +1,6 @@
 Name:           oniguruma
 Version:        6.9.5
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        BSD
 Summary:        Regular expressions library
 Group:          System Environment/Libraries
@@ -8,6 +8,8 @@ Vendor:         Microsoft Corporation
 Distribution:   Mariner
 URL:            https://github.com/kkos/oniguruma/
 Source0:        https://github.com/kkos/oniguruma/releases/download/v%{version}/onig-%{version}.tar.gz
+# https://github.com/kkos/oniguruma/commit/cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch
+Patch0:         CVE-2020-26159.patch
 
 %description
 Oniguruma is a regular expressions library.
@@ -24,7 +26,8 @@ Requires:       oniguruma = %{version}-%{release}
 Development files for libonig
 
 %prep
-%setup -q -n onig-%{version}
+%autosetup -n onig-%{version} -p1
+
 
 %build
 %configure                     \
@@ -62,6 +65,8 @@ make  check
 %{_libdir}/pkgconfig/%{name}.pc
 
 %changelog
+* Thu Oct 15 2020 Emre Girgin <mrgirgin@microsoft.com> 6.9.5-2
+- Fix CVE-2020-26159. 
 * Tue May 19 2020 Andrew Phelps <anphel@microsoft.com> 6.9.5-1
 - Upgrade to 6.9.5.
 * Wed Apr 22 2020 Emre Girgin <mrgirgin@microsoft.com> 6.9.0-4