diff --git a/at-spi-1.32.0-formatstring.patch b/at-spi-1.32.0-formatstring.patch
new file mode 100644
index 0000000..54c8092
--- /dev/null
+++ b/at-spi-1.32.0-formatstring.patch
@@ -0,0 +1,21 @@
+From e22e23075b073ef15afc57b10790e1a170331cff Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliamson@mandriva.org>
+Date: Thu, 22 Sep 2011 07:36:20 +0000
+Subject: fix string literal
+
+---
+diff --git a/test/simple-at.c b/test/simple-at.c
+index 7da2bb5..265239e 100644
+--- a/test/simple-at.c
++++ b/test/simple-at.c
+@@ -605,7 +605,7 @@ _festival_say (const char *text, const char *voice, SPIBoolean shutup)
+ static void
+ _festival_write (const gchar *command_string, int fd)
+ {
+-  fprintf(stderr, command_string);
++  fprintf(stderr, "%s", command_string);
+   if (fd < 0) {
+     perror("socket");
+     return;
+--
+cgit v0.9.2
diff --git a/at-spi.spec b/at-spi.spec
index 47050e7..e982a27 100644
--- a/at-spi.spec
+++ b/at-spi.spec
@@ -50,6 +50,8 @@ BuildRequires: automake, autoconf, libtool, intltool
 
 # http://bugzilla.gnome.org/show_bug.cgi?id=548782
 Patch0: evo-crash.patch
+# https://git.gnome.org/browse/at-spi/patch/?id=e22e230
+Patch1: at-spi-1.32.0-formatstring.patch
 
 %description
 at-spi allows assistive technologies to access GTK-based
@@ -90,6 +92,7 @@ This package contains Python bindings allowing to use at-spi in Python programs.
 %prep
 %setup -q
 %patch0 -p1 -b .evo-crash
+%patch1 -p1 -b .formatstring
 
 %build
 %configure --disable-gtk-doc --disable-static --enable-relocate
@@ -146,6 +149,7 @@ mv $RPM_BUILD_ROOT%{_datadir}/doc/%{name}-%{version} \
 
 %changelog
 * Sat Jan 18 2014 Ville Skyttä <ville.skytta@iki.fi> - 1.32.0-12
+- Fix build with -Werror=format-security (#1036994, upstream patch).
 - Adapt to unversioned docdirs where applicable (#993676).
 - Fix bogus date in %%changelog.