diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch
new file mode 100644
index 0000000000..e794d26832
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch
@@ -0,0 +1,57 @@
+From 49ea10f3c83475ad30c1b0581e2aaa3e75f4af4f Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Tue, 23 Jun 2026 09:46:33 +1000
+Subject: [PATCH] Prevent saving 1 mode images as TGA with run-length encoding
+ (#9709)
+
+CVE: CVE-2026-59198
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b]
+
+(cherry picked from commit eada3cbd7fb9963ee90673fb7b5270124a0d5f4b)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_file_tga.py    | 12 +++++++++++-
+ src/PIL/TgaImagePlugin.py |  4 ++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
+index 7ec562342..82bcf48ca 100644
+--- a/Tests/test_file_tga.py
++++ b/Tests/test_file_tga.py
+@@ -179,10 +179,20 @@ def test_save_wrong_mode(tmp_path: Path) -> None:
+     im = hopper("PA")
+     out = tmp_path / "temp.tga"
+ 
+-    with pytest.raises(OSError):
++    with pytest.raises(OSError, match="cannot write mode PA as TGA"):
+         im.save(out)
+ 
+ 
++def test_save_1_mode_rle(tmp_path: Path) -> None:
++    im = Image.new("1", (1, 1))
++    out = tmp_path / "temp.tga"
++
++    with pytest.raises(
++        OSError, match="cannot write mode 1 as TGA with run-length encoding"
++    ):
++        im.save(out, compression="tga_rle")
++
++
+ def test_save_mapdepth() -> None:
+     # This image has been manually hexedited from 200x32_p_bl_raw.tga
+     # to include an origin
+diff --git a/src/PIL/TgaImagePlugin.py b/src/PIL/TgaImagePlugin.py
+index b2989a4b7..8fd63b1df 100644
+--- a/src/PIL/TgaImagePlugin.py
++++ b/src/PIL/TgaImagePlugin.py
+@@ -205,6 +205,10 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:
+         compression = im.encoderinfo.get("compression", im.info.get("compression"))
+         rle = compression == "tga_rle"
+     if rle:
++        if im.mode == "1":
++            msg = f"cannot write mode {im.mode} as TGA with run-length encoding"
++            raise OSError(msg)
++
+         imagetype += 8
+ 
+     id_section = im.encoderinfo.get("id_section", im.info.get("id_section", ""))
diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
index f9d91e0889..331b99622b 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
@@ -12,6 +12,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \
            file://CVE-2026-55380.patch \
            file://CVE-2026-59197.patch \
+           file://CVE-2026-59198.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"