diff --git a/third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc b/third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc
index c83867e2a29..e8ef843b8ea 100644
--- a/third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc
+++ b/third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc
@@ -477,6 +477,14 @@ void VideoCaptureModulePipeWire::ProcessBuffers() {
       continue;
     }
 
+    if (static_cast<uint64_t>(spaBuffer->datas[0].chunk->offset) +
+            spaBuffer->datas[0].chunk->size >
+        spaBuffer->datas[0].maxsize) {
+      RTC_LOG(LS_ERROR) << "Dropping frame with invalid size";
+      pw_stream_queue_buffer(stream_, buffer);
+      continue;
+    }
+
     if (spaBuffer->datas[0].type == SPA_DATA_DmaBuf ||
         spaBuffer->datas[0].type == SPA_DATA_MemFd) {
       ScopedBuf frame;
diff --git a/third_party/libwebrtc/moz-patch-stack/612430e826.no-op-cherry-pick-msg b/third_party/libwebrtc/moz-patch-stack/612430e826.no-op-cherry-pick-msg
new file mode 100644
index 00000000000..c1a3939335d
--- /dev/null
+++ b/third_party/libwebrtc/moz-patch-stack/612430e826.no-op-cherry-pick-msg
@@ -0,0 +1 @@
+We cherry-picked this in bug 2054625.
\ No newline at end of file