diff --git a/SPECS/rubygem-rubyzip/CVE-2026-85396.patch b/SPECS/rubygem-rubyzip/CVE-2026-85396.patch
new file mode 100644
index 00000000000..0f40ffa3e22
--- /dev/null
+++ b/SPECS/rubygem-rubyzip/CVE-2026-85396.patch
@@ -0,0 +1,40 @@
+From 4bb8bb68203b3da8658a055c1cca1d0e7f6d1164 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 7 Sep 2026 04:43:50 +0000
+Subject: [PATCH] Prevent entries from being extracted outside specified
+ directory.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449.patch
+---
+ test/data/path_traversal/out_evil.zip | Bin 0 -> 294 bytes
+ test/path_traversal_test.rb           |   2 ++
+ 2 files changed, 2 insertions(+)
+ create mode 100644 test/data/path_traversal/out_evil.zip
+
+diff --git a/test/data/path_traversal/out_evil.zip b/test/data/path_traversal/out_evil.zip
+new file mode 100644
+index 0000000000000000000000000000000000000000..e99f4d92dcc8b6d619f2b4b81d6ddb18f0d175aa
+GIT binary patch
+literal 294
+zcmWIWW@Zs#0D=B#r((biD8U1y_4M@fOH1NY%QAEH1Ar=ZfnpqBl_hIdKl%>^5)2|J
+zDwB#*6SIN(^hzp97#Rc@*q|nIKxuESQ|JB8GBX5tGcuVl<F*~7oDqoMI)YfJZUO1U
+j?HZ7Jkj^EIT4*{6xh=q(73^Fl1}26nK)p3U%)kHu3Oht(
+
+literal 0
+HcmV?d00001
+
+diff --git a/test/path_traversal_test.rb b/test/path_traversal_test.rb
+index 47c7e30..ab457d9 100644
+--- a/test/path_traversal_test.rb
++++ b/test/path_traversal_test.rb
+@@ -171,4 +171,6 @@ class PathTraversalTest < MiniTest::Test
+       assert File.exist?('~tilde~')
+     end
+   end
++
++
+ end
+-- 
+2.45.4
+
diff --git a/SPECS/rubygem-rubyzip/rubygem-rubyzip.spec b/SPECS/rubygem-rubyzip/rubygem-rubyzip.spec
index 218447856a6..49f583309fd 100644
--- a/SPECS/rubygem-rubyzip/rubygem-rubyzip.spec
+++ b/SPECS/rubygem-rubyzip/rubygem-rubyzip.spec
@@ -3,13 +3,14 @@
 Summary:        a ruby module for reading and writing zip files
 Name:           rubygem-%{gem_name}
 Version:        2.3.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Group:          Development/Languages
 URL:            https://github.com/rubyzip/rubyzip
 Source0:        https://github.com/rubyzip/rubyzip/archive/refs/tags/v%{version}.tar.gz#/%{gem_name}-%{version}.tar.gz
+Patch0:         CVE-2026-85396.patch
 BuildRequires:  git
 BuildRequires:  ruby
 Provides:       rubygem(%{gem_name}) = %{version}-%{release}
@@ -19,6 +20,7 @@ Rubyzip is a ruby library for reading and writing zip files.
 
 %prep
 %setup -q -n %{gem_name}-%{version}
+%patch 0 -p1
 
 %build
 gem build %{gem_name}
@@ -31,6 +33,9 @@ gem install -V --local --force --install-dir %{buildroot}/%{gemdir} %{gem_name}-
 %{gemdir}
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.3.2-2
+- Patch for CVE-2026-85396
+
 * Thu Nov 02 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 2.3.2-1
 - Auto-upgrade to 2.3.2 - Azure Linux 3.0 - package upgrades