diff --git a/gfx/cairo/28-win32-vertical-glyph-advance-direction.patch b/gfx/cairo/28-win32-vertical-glyph-advance-direction.patch
new file mode 100644
index 000000000000..98da3d6f0f3c
--- /dev/null
+++ b/gfx/cairo/28-win32-vertical-glyph-advance-direction.patch
@@ -0,0 +1,13 @@
+diff --git a/gfx/cairo/cairo/src/win32/cairo-win32-surface.c b/gfx/cairo/cairo/src/win32/cairo-win32-surface.c
+--- a/gfx/cairo/cairo/src/win32/cairo-win32-surface.c
++++ b/gfx/cairo/cairo/src/win32/cairo-win32-surface.c
+@@ -347,7 +347,8 @@ cairo_int_status_t
+             next_logical_y = _cairo_lround (next_user_y);
+ 
+             dxy_buf[j] = _cairo_lround (next_logical_x - logical_x);
+-            dxy_buf[j+1] = _cairo_lround (next_logical_y - logical_y);
++            /* Note that GDI coordinate system is inverted! */
++            dxy_buf[j+1] = _cairo_lround (logical_y - next_logical_y);
+ 
+             logical_x = next_logical_x;
+             logical_y = next_logical_y;
diff --git a/gfx/cairo/README b/gfx/cairo/README
index 4e10c983cf83..51ec6bb157fd 100644
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@@ -52,6 +52,8 @@ cff-font-creation.patch: make cairo_cff_font_t allocation consistent
 
 27-windows-sdk-26100.patch: fix build bustage with Windows SDK 26100
 
+28-win32-vertical-glyph-advance-direction.patch: fix sign of glyph y-advance for ExtTextOut
+
 ==== pixman patches ====
 
 pixman-armasm.patch: add an ifdef guard around pixman-config.h include
diff --git a/gfx/cairo/cairo/src/win32/cairo-win32-surface.c b/gfx/cairo/cairo/src/win32/cairo-win32-surface.c
index 9cd6f55fcccd..13b319161801 100644
--- a/gfx/cairo/cairo/src/win32/cairo-win32-surface.c
+++ b/gfx/cairo/cairo/src/win32/cairo-win32-surface.c
@@ -347,7 +347,8 @@ _cairo_win32_surface_emit_glyphs (cairo_win32_surface_t *dst,
             next_logical_y = _cairo_lround (next_user_y);
 
             dxy_buf[j] = _cairo_lround (next_logical_x - logical_x);
-            dxy_buf[j+1] = _cairo_lround (next_logical_y - logical_y);
+            /* Note that GDI coordinate system is inverted! */
+            dxy_buf[j+1] = _cairo_lround (logical_y - next_logical_y);
 
             logical_x = next_logical_x;
             logical_y = next_logical_y;