diff --git a/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/CVE-2026-105842.patch b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/CVE-2026-105842.patch
new file mode 100644
index 00000000000..afa6a8ab3b4
--- /dev/null
+++ b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/CVE-2026-105842.patch
@@ -0,0 +1,57 @@
+From f8caa7b1b1a3a1bb50cf08677b15be7b17c2956f Mon Sep 17 00:00:00 2001
+From: Uwe Ohse at akiar <uwe@ohse.de>
+Date: Mon, 10 Aug 2026 18:40:36 +0200
+Subject: [PATCH] avoid buffer overflows by strdup instead of
+ malloc(PATH_MAX+...).
+
+CVE: CVE-2026-105842
+Upstream-Status: Backport [https://github.com/UweOhse/lrzsz/commit/f8caa7b1b1a3a1bb50cf08677b15be7b17c2956f]
+
+Backport Changes:
+- Omitted NEWS because its 0.13.0 release-note hunk conflicts with the
+  0.12.20 release history and is not needed for the security fix.
+
+(cherry picked from commit f8caa7b1b1a3a1bb50cf08677b15be7b17c2956f)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/lrz.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/lrz.c b/src/lrz.c
+index 168636e..e11f909 100644
+--- a/src/lrz.c
++++ b/src/lrz.c
+@@ -743,11 +743,10 @@ wcreceive(int argc, char **argp)
+ 		if (Pathname)
+ 			free(Pathname);
+ 		errno=0;
+-		Pathname=malloc(PATH_MAX+1);
++		Pathname=strdup(*argp);
+ 		if (!Pathname)
+ 			error(1,0,_("out of memory"));
+ 
+-		strcpy(Pathname, *argp);
+ 		checkpath(Pathname);
+ #ifdef ENABLE_SYSLOG
+ 		shortname=strrchr(*argp,'/');
+@@ -1288,15 +1287,16 @@ procheader(char *name, struct zm_fileinfo *zi)
+                 return OK; /* dummy */
+         if (Pathname)
+                 free(Pathname);
+-        Pathname=malloc((PATH_MAX)*2);
++
++        Pathname=strdup(name_static);
+         if (!Pathname)
+                 error(1,0,_("out of memory"));
+-        strcpy(Pathname, name_static);
+         if (Verbose) {
+                 /* overwrite the "waiting to receive" line */
+                 vstring("\r                                                                     \r");
+                 vstringf(_("Receiving: %s\n"), name_static);
+         }
++
+         checkpath(name_static);
+         if (Nflag)
+         {
+-- 
+2.35.6
diff --git a/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb b/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb
index ec98f690153..a6d1f62c61e 100644
--- a/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb
+++ b/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb
@@ -23,6 +23,7 @@ SRC_URI = "https://www.ohse.de/uwe/releases/lrzsz-${PV}.tar.gz \
            file://0001-lrzsz-convert-K-R-function-definitions-to-ANSI-C-pro.patch \
            file://CVE-2026-105841.patch \
            file://CVE-2026-105840.patch \
+           file://CVE-2026-105842.patch \
            "
 SRC_URI[sha256sum] = "c28b36b14bddb014d9e9c97c52459852f97bd405f89113f30bee45ed92728ff1"