new file mode 100644
@@ -0,0 +1,60 @@
+From eada3cbd7fb9963ee90673fb7b5270124a0d5f4b Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Tue, 23 Jun 2026 09:46:33 +1000
+Subject: [PATCH] Prevent saving 1 mode images as TGA with run-length
+encoding
+ (#9709)
+
+CVE: CVE-2026-59198
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b]
+
+Signed-off-by: Rohini Sangam <rsangam@mvista.com>
+---
+ Tests/test_file_tga.py | 12 +++++++++++-
+ src/PIL/TgaImagePlugin.py | 4 ++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
+index ff6dab00d..c03282142 100644
+--- a/Tests/test_file_tga.py
++++ b/Tests/test_file_tga.py
+@@ -147,10 +147,20 @@ def test_save_wrong_mode(tmp_path: Path) -> None:
+ im = hopper("PA")
+ out = str(tmp_path / "temp.tga")
+
+- with pytest.raises(OSError):
++ with pytest.raises(OSError, match="cannot write mode PA as TGA"):
+ im.save(out)
+
+
++def test_save_1_mode_rle(tmp_path: Path) -> None:
++ im = Image.new("1", (1, 1))
++ out = tmp_path / "temp.tga"
++
++ with pytest.raises(
++ OSError, match="cannot write mode 1 as TGA with run-length encoding"
++ ):
++ im.save(out, compression="tga_rle")
++
++
+ def test_save_mapdepth() -> None:
+ # This image has been manually hexedited from 200x32_p_bl_raw.tga
+ # to include an origin
+diff --git a/src/PIL/TgaImagePlugin.py b/src/PIL/TgaImagePlugin.py
+index 401a83f9f..e8fd297cf 100644
+--- a/src/PIL/TgaImagePlugin.py
++++ b/src/PIL/TgaImagePlugin.py
+@@ -191,6 +191,10 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str) -> None:
+ compression = im.encoderinfo.get("compression", im.info.get("compression"))
+ rle = compression == "tga_rle"
+ if rle:
++ if im.mode == "1":
++ msg = f"cannot write mode {im.mode} as TGA with run-length encoding"
++ raise OSError(msg)
++
+ imagetype += 8
+
+ id_section = im.encoderinfo.get("id_section", im.info.get("id_section", ""))
+--
+2.44.4
+
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https
file://run-ptest \
file://CVE-2026-25990.patch \
file://CVE-2026-40192.patch \
+ file://CVE-2026-59198.patch \
"
SRCREV = "5c89d88eee199ba53f64581ea39b6a1bc52feb1a"
Pick patch from [1] also mentioned at NVD report in [2] [1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b [2] https://nvd.nist.gov/vuln/detail/cve-2026-59198 Signed-off-by: Rohini Sangam <rsangam@mvista.com> --- .../python3-pillow/CVE-2026-59198.patch | 60 +++++++++++++++++++ .../python/python3-pillow_10.3.0.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch