new file mode 100644
@@ -0,0 +1,74 @@
+From cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Sat, 20 Jun 2026 11:53:14 +1000
+Subject: [PATCH] Validate large filter sizes when initializing RankFilter
+ (#9695)
+
+CVE: CVE-2026-59197
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1]
+
+Backport Changes:
+- Adapted the ImagingExpand check to Pillow 12.2.0's two-margin API.
+ It checks the larger margin and guards against zero before division;
+ the regression test passes both margins.
+
+(cherry picked from commit cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_image_filter.py | 5 +++++
+ src/PIL/ImageFilter.py | 3 +++
+ src/libImaging/Filter.c | 5 +++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/Tests/test_image_filter.py b/Tests/test_image_filter.py
+index e566cd055..4bed605 100644
+--- a/Tests/test_image_filter.py
++++ b/Tests/test_image_filter.py
+@@ -141,6 +141,11 @@ def test_rankfilter_properties() -> None:
+ assert rankfilter.size == 1
+ assert rankfilter.rank == 2
+
++ with pytest.raises(ValueError, match="filter size too large"):
++ ImageFilter.RankFilter(23171, 1)
++ im = Image.new("1", (1, 1))
++ with pytest.raises(ValueError, match="filter size too large"):
++ im.im.expand(23171, 23171)
+
+ def test_builtinfilter_p() -> None:
+ builtin_filter = ImageFilter.BuiltinFilter()
+
+diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py
+index 9326eeeda..2c73c27bc 100644
+--- a/src/PIL/ImageFilter.py
++++ b/src/PIL/ImageFilter.py
+@@ -99,6 +99,9 @@ class RankFilter(Filter):
+ name = "Rank"
+
+ def __init__(self, size: int, rank: int) -> None:
++ if size * size * 4 > (2**31 - 1):
++ msg = "filter size too large"
++ raise ValueError(msg)
+ self.size = size
+ self.rank = rank
+
+diff --git a/src/libImaging/Filter.c b/src/libImaging/Filter.c
+index cefb8fc..5288754 100644
+--- a/src/libImaging/Filter.c
++++ b/src/libImaging/Filter.c
+@@ -54,11 +54,16 @@ Imaging
+ ImagingExpand(Imaging imIn, int xmargin, int ymargin) {
+ Imaging imOut;
+ int x, y;
++ int margin;
+ ImagingSectionCookie cookie;
+
+ if (xmargin < 0 && ymargin < 0) {
+ return (Imaging)ImagingError_ValueError("bad kernel size");
+ }
++ margin = xmargin > ymargin ? xmargin : ymargin;
++ if (margin > 0 && margin > (INT_MAX / (int)sizeof(FLOAT32)) / margin) {
++ return (Imaging)ImagingError_ValueError("filter size too large");
++ }
+
+ imOut = ImagingNewDirty(
+ imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin
@@ -11,6 +11,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
file://CVE-2026-59204.patch \
file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \
file://CVE-2026-55380.patch \
+ file://CVE-2026-59197.patch \
"
SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-pillow/CVE-2026-59197.patch | 74 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 75 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59197.patch