diff --git a/SPECS/qtbase/CVE-2026-15037.patch b/SPECS/qtbase/CVE-2026-15037.patch
new file mode 100644
index 00000000000..8f8d93dbab9
--- /dev/null
+++ b/SPECS/qtbase/CVE-2026-15037.patch
@@ -0,0 +1,60 @@
+From dc894578e46decc1e6a43987a6683841b7759e9f Mon Sep 17 00:00:00 2001
+From: Magdalena Stojek <magdalena.stojek@qt.io>
+Date: Fri, 26 Jun 2026 13:44:42 +0200
+Subject: [PATCH] QDom: Change default InvalidDataPolicy to ReturnNullNode
+
+Previously, the default InvalidDataPolicy was AcceptInvalidChars, which
+caused QDomDocument factory functions to silently accept data containing
+characters not permitted in XML 1.0. The resulting document could then
+be serialized producing malformed XML without any indication to the
+caller.
+Change the default to ReturnNullNode so that factory functions called
+with invalid data return a null node.
+
+[ChangeLog][QtXml][QDomImplementation] The default InvalidDataPolicy has
+changed from AcceptInvalidChars to ReturnNullNode. Factory functions in
+QDomDocument now return a null node when called with data invalid per
+XML 1.0, instead of silently accepting it.
+
+Pick-to: 6.12
+Fixes: QTBUG-147717
+Change-Id: I583035fc63e9a4d947df4da3a5122cb43d631ed2
+Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/qt/qtbase/commit/bf1ae5862807ec2b9a411506d59ccd566937a4c7.patch
+---
+ src/xml/dom/qdom.cpp | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/xml/dom/qdom.cpp b/src/xml/dom/qdom.cpp
+index 29145f67..1dd1ff7b 100644
+--- a/src/xml/dom/qdom.cpp
++++ b/src/xml/dom/qdom.cpp
+@@ -91,7 +91,7 @@ static void qt_split_namespace(QString& prefix, QString& name, const QString& qN
+  *
+  **************************************************************/
+ QDomImplementation::InvalidDataPolicy QDomImplementationPrivate::invalidDataPolicy
+-    = QDomImplementation::AcceptInvalidChars;
++    = QDomImplementation::ReturnNullNode;
+ 
+ // [5] Name ::= (Letter | '_' | ':') (NameChar)*
+ 
+@@ -541,11 +541,12 @@ bool QDomImplementation::isNull()
+     This enum specifies what should be done when a factory function
+     in QDomDocument is called with invalid data.
+     \value AcceptInvalidChars The data should be stored in the DOM object
+-        anyway. In this case the resulting XML document might not be well-formed.
+-        This is the default value and QDom's behavior in Qt < 4.1.
++           anyway. In this case the resulting XML document might not be well-formed.
++           This was the default value and QDom's behavior prior to Qt 6.12.
+     \value DropInvalidChars The invalid characters should be removed from
+-        the data.
++           the data.
+     \value ReturnNullNode The factory function should return a null node.
++           This is the default value since Qt 6.12.
+ 
+     \sa setInvalidDataPolicy(), invalidDataPolicy()
+ */
+-- 
+2.45.4
+
diff --git a/SPECS/qtbase/qtbase.spec b/SPECS/qtbase/qtbase.spec
index cc7db91a5d1..35655f3ae9a 100644
--- a/SPECS/qtbase/qtbase.spec
+++ b/SPECS/qtbase/qtbase.spec
@@ -35,7 +35,7 @@
 Name:         qtbase
 Summary:      Qt6 - QtBase components
 Version:      6.6.3
-Release:      4%{?dist}
+Release:      5%{?dist}
 # See LICENSE.GPL3-EXCEPT.txt, for exception details
 License:      GFDL AND LGPLv3 AND GPLv2 AND GPLv3 with exceptions AND QT License Agreement 4.0
 Vendor:       Microsoft Corporation
@@ -99,6 +99,7 @@ Patch61: qtbase-cxxflag.patch
 Patch65: qtbase-mysql.patch
 Patch66: CVE-2025-30348.patch
 Patch67: CVE-2025-5455.patch
+Patch68: CVE-2026-15037.patch
 
 # Do not check any files in %%{_qt_plugindir}/platformthemes/ for requires.
 # Those themes are there for platform integration. If the required libraries are
@@ -703,6 +704,9 @@ fi
 %{_qt_plugindir}/platformthemes/libqxdgdesktopportal.so
 
 %changelog
+* Wed Jul 29 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 6.6.3-5
+- Patch for CVE-2026-15037
+
 * Fri Jun 27 2025 Akhila Guruju <v-guakhila@microsoft.com> - 6.6.3-4
 - Patch CVE-2025-5455