diff --git a/gfx/cairo/cairo/src/cairo-ft-font.c b/gfx/cairo/cairo/src/cairo-ft-font.c
index dc98acaf67c..c637942e455 100644
--- a/gfx/cairo/cairo/src/cairo-ft-font.c
+++ b/gfx/cairo/cairo/src/cairo-ft-font.c
@@ -1443,27 +1443,29 @@ _get_bitmap_surface (FT_Bitmap		     *bitmap,
 	    if (error)
 		return _cairo_error (_cairo_ft_to_cairo_error (error));
 
-	    FT_Bitmap_Done( library, bitmap );
-	    *bitmap = tmp;
-
-	    stride = bitmap->pitch;
+            /* tmp is our locally-managed view of bitmap, which belongs to
+             * the glyph slot. Only access and free tmp. */
+	    stride = tmp.pitch;
 	    data = _cairo_malloc_ab (height, stride);
-	    if (!data)
+	    if (!data) {
+		FT_Bitmap_Done( library, &tmp );
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+	    }
 
-	    if (bitmap->num_grays != 256)
+	    if (tmp.num_grays != 256)
 	    {
 	      unsigned int x, y;
-	      unsigned int mul = 255 / (bitmap->num_grays - 1);
-	      FT_Byte *p = bitmap->buffer;
+	      unsigned int mul = 255 / (tmp.num_grays - 1);
+	      FT_Byte *p = tmp.buffer;
 	      for (y = 0; y < height; y++) {
 	        for (x = 0; x < width; x++)
 		  p[x] *= mul;
-		p += bitmap->pitch;
+		p += tmp.pitch;
 	      }
 	    }
 
-	    memcpy (data, bitmap->buffer, (size_t)stride * height);
+	    memcpy (data, tmp.buffer, (size_t)stride * height);
+	    FT_Bitmap_Done( library, &tmp );
 	    break;
 	}
 	/* fall through */
diff --git a/gfx/cairo/moz.yaml b/gfx/cairo/moz.yaml
index bc993859e93..6edeba89622 100644
--- a/gfx/cairo/moz.yaml
+++ b/gfx/cairo/moz.yaml
@@ -94,6 +94,7 @@ vendoring:
     - patches/0048-Bug-2054626-type2-decode-integer.patch
     - patches/0049-Bug-2054627-skip-token-check.patch
     - patches/0050-Bug-2065397-array-bounds-check.patch
+    - patches/0051-Bug-2068367-bitmap-surface-tmp-buffer.patch
 
 updatebot:
   maintainer-phab: "#gfx-reviewers"
diff --git a/gfx/cairo/patches/0051-Bug-2068367-bitmap-surface-tmp-buffer.patch b/gfx/cairo/patches/0051-Bug-2068367-bitmap-surface-tmp-buffer.patch
new file mode 100644
index 00000000000..5816e1fd799
--- /dev/null
+++ b/gfx/cairo/patches/0051-Bug-2068367-bitmap-surface-tmp-buffer.patch
@@ -0,0 +1,44 @@
+diff --git a/gfx/cairo/cairo/src/cairo-ft-font.c b/gfx/cairo/cairo/src/cairo-ft-font.c
+index dc98acaf67c6..c637942e455c 100644
+--- a/src/cairo-ft-font.c
++++ b/src/cairo-ft-font.c
+@@ -1443,27 +1443,29 @@ _get_bitmap_surface (FT_Bitmap		     *bitmap,
+ 	    if (error)
+ 		return _cairo_error (_cairo_ft_to_cairo_error (error));
+ 
+-	    FT_Bitmap_Done( library, bitmap );
+-	    *bitmap = tmp;
+-
+-	    stride = bitmap->pitch;
++            /* tmp is our locally-managed view of bitmap, which belongs to
++             * the glyph slot. Only access and free tmp. */
++	    stride = tmp.pitch;
+ 	    data = _cairo_malloc_ab (height, stride);
+-	    if (!data)
++	    if (!data) {
++		FT_Bitmap_Done( library, &tmp );
+ 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
++	    }
+ 
+-	    if (bitmap->num_grays != 256)
++	    if (tmp.num_grays != 256)
+ 	    {
+ 	      unsigned int x, y;
+-	      unsigned int mul = 255 / (bitmap->num_grays - 1);
+-	      FT_Byte *p = bitmap->buffer;
++	      unsigned int mul = 255 / (tmp.num_grays - 1);
++	      FT_Byte *p = tmp.buffer;
+ 	      for (y = 0; y < height; y++) {
+ 	        for (x = 0; x < width; x++)
+ 		  p[x] *= mul;
+-		p += bitmap->pitch;
++		p += tmp.pitch;
+ 	      }
+ 	    }
+ 
+-	    memcpy (data, bitmap->buffer, (size_t)stride * height);
++	    memcpy (data, tmp.buffer, (size_t)stride * height);
++	    FT_Bitmap_Done( library, &tmp );
+ 	    break;
+ 	}
+ 	/* fall through */