diff --git a/SPECS/rsyslog/CVE-2026-78002.patch b/SPECS/rsyslog/CVE-2026-78002.patch
new file mode 100644
index 00000000000..795d30a1836
--- /dev/null
+++ b/SPECS/rsyslog/CVE-2026-78002.patch
@@ -0,0 +1,48 @@
+From cc698584858a71fa6702aa65b18c92079e0e21f5 Mon Sep 17 00:00:00 2001
+From: Rainer Gerhards <rgerhards@adiscon.com>
+Date: Thu, 20 Aug 2026 15:53:16 +0200
+Subject: [PATCH] rainerscript: align replace sizing rewind
+
+Why:
+The sizing pass skipped a candidate match that the copy pass replaced.
+
+Impact:
+Overlapping partial matches now receive a correctly sized output string.
+
+Before/After:
+Before, the two passes resumed at different source offsets; after, both
+resume at the same offset.
+
+Technical Overview:
+Make the sizing pass rewind both its source index and tentative output
+length by the full failed partial-match length. This mirrors the copy pass
+and ensures that every replacement counted is also written exactly once.
+The change preserves the existing empty-find, replacement, and trailing
+partial-match behavior.
+
+With the help of AI-Agents: Codex
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/rsyslog/rsyslog/commit/667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9.patch
+---
+ grammar/rainerscript.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c
+index 69d0b38..8c1c4a1 100644
+--- a/grammar/rainerscript.c
++++ b/grammar/rainerscript.c
+@@ -1760,8 +1760,8 @@ doFuncReplace(struct svar *__restrict__ const operandVal, struct svar *__restric
+ 		if (src_buff[i] == find[j]) {
+ 			j++;
+ 		} else if (j > 0) {
+-			i -= (j - 1);
+-			lDst -= (j - 1);
++            i -= j;
++            lDst -= j;
+ 			j = 0;
+ 		}
+ 	}
+-- 
+2.45.4
+
diff --git a/SPECS/rsyslog/rsyslog.spec b/SPECS/rsyslog/rsyslog.spec
index 45d9a1ae944..5c48bdd142d 100644
--- a/SPECS/rsyslog/rsyslog.spec
+++ b/SPECS/rsyslog/rsyslog.spec
@@ -3,7 +3,7 @@
 Summary:        Rocket-fast system for log processing
 Name:           rsyslog
 Version:        8.2308.0
-Release:        6%{?dist}
+Release:        7%{?dist}
 License:        GPLv3+ AND ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -18,6 +18,7 @@ Source4:        https://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{bas
 Source5:        rsyslog.logrotate
 Patch0:         issue5158.patch
 Patch1:         CVE-2026-19654.patch
+Patch2:         CVE-2026-78002.patch
 BuildRequires:  autogen
 BuildRequires:  curl-devel
 BuildRequires:  gnutls-devel
@@ -204,6 +205,9 @@ fi
 %{_libdir}/rsyslog/omsnmp.so
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.2308.0-7
+- Patch for CVE-2026-78002
+
 * Sun Aug 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.2308.0-6
 - Patch for CVE-2026-19654