new file mode 100644
@@ -0,0 +1,62 @@
+From 176781ac99ebf9aa5486384e6e2e4896b30d95b5 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Sun, 21 Jun 2026 14:06:24 +1000
+Subject: [PATCH] Add decompression bomb check to GdImageFile (#9693)
+
+CVE: CVE-2026-55380
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675]
+
+(cherry picked from commit f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_file_gd.py | 8 +++++++-
+ src/PIL/GdImageFile.py | 3 ++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/Tests/test_file_gd.py b/Tests/test_file_gd.py
+index 8a49fd4fa..7d9e85976 100644
+--- a/Tests/test_file_gd.py
++++ b/Tests/test_file_gd.py
+@@ -4,7 +4,7 @@ from io import BytesIO
+
+ import pytest
+
+-from PIL import GdImageFile, UnidentifiedImageError
++from PIL import GdImageFile, Image, UnidentifiedImageError, _binary
+
+ from .helper import assert_image_similar_tofile
+
+@@ -31,6 +31,12 @@ def test_bad_mode() -> None:
+ GdImageFile.open(TEST_GD_FILE, "bad mode")
+
+
++def test_decompression_bomb() -> None:
++ b = BytesIO(_binary.o16be(65535) + _binary.o16be(50000) + _binary.o16be(50000))
++ with pytest.raises(Image.DecompressionBombError):
++ GdImageFile.open(b)
++
++
+ def test_invalid_file() -> None:
+ invalid_file = "Tests/images/flower.jpg"
+
+diff --git a/src/PIL/GdImageFile.py b/src/PIL/GdImageFile.py
+index d73bc1982..4ff96f1fa 100644
+--- a/src/PIL/GdImageFile.py
++++ b/src/PIL/GdImageFile.py
+@@ -30,7 +30,7 @@ from __future__ import annotations
+
+ from typing import IO
+
+-from . import ImageFile, ImagePalette, UnidentifiedImageError
++from . import Image, ImageFile, ImagePalette, UnidentifiedImageError
+ from ._binary import i16be as i16
+ from ._binary import i32be as i32
+ from ._typing import StrOrBytesPath
+@@ -59,6 +59,7 @@ class GdImageFile(ImageFile.ImageFile):
+
+ self._mode = "P"
+ self._size = i16(s, 2), i16(s, 4)
++ Image._decompression_bomb_check(self.size)
+
+ true_color = s[6]
+ true_color_offset = 2 if true_color else 0
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
file://CVE-2026-54058.patch \
file://CVE-2026-59204.patch \
file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \
+ file://CVE-2026-55380.patch \
"
SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-pillow/CVE-2026-55380.patch | 62 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 63 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch