diff --git a/pkgs/development/libraries/spandsp/3.nix b/pkgs/development/libraries/spandsp/3.nix
index 5a7f0005a407..3d10c91e4b4e 100644
--- a/pkgs/development/libraries/spandsp/3.nix
+++ b/pkgs/development/libraries/spandsp/3.nix
@@ -12,6 +12,11 @@
     rev = "6ec23e5a7e411a22d59e5678d12c4d2942c4a4b6"; # upstream does not seem to believe in tags
     sha256 = "03w0s99y3zibi5fnvn8lk92dggfgrr0mz5255745jfbz28b2d5y7";
   };
+
+  patches = [
+    # https://github.com/freeswitch/spandsp/pull/120
+    ./Fix-buffer-overrun-in-t85-tests.patch
+  ];
 }).overrideAttrs
   (
     finalAttrs: previousAttrs: {
diff --git a/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch b/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch
new file mode 100644
index 000000000000..de78212f7379
--- /dev/null
+++ b/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch
@@ -0,0 +1,29 @@
+From bc1c899fa1b6746d430f7b3d7ee288506d50441a Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 11 May 2026 08:51:29 +0200
+Subject: [PATCH] Fix buffer overrun in t85 tests
+
+The variable length tests involve reading an extra row from
+test_image, which would previously read past the end of test_image.
+
+Identified with fortify-headers.
+---
+ tests/t85_tests.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/t85_tests.c b/tests/t85_tests.c
+index 436dfca..671ee6c 100644
+--- a/tests/t85_tests.c
++++ b/tests/t85_tests.c
+@@ -55,7 +55,7 @@ in ITU specifications T.85.
+ #include "spandsp.h"
+ 
+ #define TESTBUF_SIZE        400000
+-#define TEST_IMAGE_SIZE     (1951*1960/8)
++#define TEST_IMAGE_SIZE     (1952*1960/8)
+ 
+ uint8_t testbuf[TESTBUF_SIZE];
+ uint8_t test_image[TEST_IMAGE_SIZE];
+-- 
+2.53.0
+