diff --git a/binutils-CVE-2022-38533.patch b/binutils-CVE-2022-38533.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ecb1508ff536e074b54c2cb1d7e301bcdc081e83
--- /dev/null
+++ b/binutils-CVE-2022-38533.patch
@@ -0,0 +1,29 @@
+commit ef186fe54aa6d281a3ff8a9528417e5cc614c797
+Author: Alan Modra <amodra@gmail.com>
+Date:   Sat Aug 13 15:32:47 2022 +0930
+
+    PR29482 - strip: heap-buffer-overflow
+    
+            PR 29482
+            * coffcode.h (coff_set_section_contents): Sanity check _LIB.
+
+diff --git a/bfd/coffcode.h b/bfd/coffcode.h
+index 67aaf158ca1..52027981c3f 100644
+--- a/bfd/coffcode.h
++++ b/bfd/coffcode.h
+@@ -4302,10 +4302,13 @@ coff_set_section_contents (bfd * abfd,
+ 
+ 	rec = (bfd_byte *) location;
+ 	recend = rec + count;
+-	while (rec < recend)
++	while (recend - rec >= 4)
+ 	  {
++	    size_t len = bfd_get_32 (abfd, rec);
++	    if (len == 0 || len > (size_t) (recend - rec) / 4)
++	      break;
++	    rec += len * 4;
+ 	    ++section->lma;
+-	    rec += bfd_get_32 (abfd, rec) * 4;
+ 	  }
+ 
+ 	BFD_ASSERT (rec == recend);
diff --git a/mingw-binutils.spec b/mingw-binutils.spec
index f551eb5a018f0e37a3d2638622bdc89055b64b02..d2ef8fbdc4790034cc84d430ac91fd992f29dc08 100644
--- a/mingw-binutils.spec
+++ b/mingw-binutils.spec
@@ -2,7 +2,7 @@
 
 Name:           mingw-binutils
 Version:        2.37
-Release:        2
+Release:        3
 Summary:        Cross-compiled version of binutils for Win32 and Win64 environments
 
 License:        GPLv2+ and LGPLv2+ and GPLv3+ and LGPLv3+
@@ -119,6 +119,14 @@ Patch16: binutils-testsuite-fixes.patch
 # Lifetime: Fixed in 2.38 maybe
 Patch17: binutils-gold-i386-gnu-property-notes.patch
 
+# Purpose:  In GNU Binutils before 2.40, there is a heap-buffer-overflow 
+#            in the error function bfd_getl32 when called from the 
+#            strip_main function in strip-new via a crafted file.
+# Lifetime: Fixed in 2.40 maybe
+
+
+Patch18: binutils-CVE-2022-38533.patch
+
 
 BuildRequires:  make
 BuildRequires:  gcc
@@ -373,6 +381,9 @@ rm -rf %{buildroot}%{_mandir}/man1/*
 
 
 %changelog
+* Fri Jul 19 2024 xuguangmin <xuguangmin@kylinos.cn> - 2.37-3
+- Fix CVE-2022-38533
+
 * Mon Feb 5 2024 yinhongchang <yinhongchang@kylinsec.com.cn> - 2.37-2
 - update version to 2.37-2
 
@@ -383,4 +394,4 @@ rm -rf %{buildroot}%{_mandir}/man1/*
 - update version to 2.34-9
 
 * Thu Oct 08 2020 Zhiyi Weng <zhiyi@iscas.ac.cn> - 2.32-7
-- Initial version
\ No newline at end of file
+- Initial version