new file mode 100644
@@ -0,0 +1,84 @@
+From 0d706085cfb87ffac6eea54f1a42ce8bd3f16513 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Mon, 22 Jun 2026 12:56:41 +1000
+Subject: [PATCH] Use int64_t to calculate paste box dimensions (#9703)
+
+CVE: CVE-2026-59199
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b]
+
+(cherry picked from commit ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_image_paste.py | 14 ++++++++++++++
+ src/libImaging/Paste.c | 12 ++++++------
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/Tests/test_image_paste.py b/Tests/test_image_paste.py
+index 37e4df103..f9b72e46f 100644
+--- a/Tests/test_image_paste.py
++++ b/Tests/test_image_paste.py
+@@ -357,6 +357,20 @@ class TestImagingPaste:
+ im.copy().paste(im2)
+ im.copy().paste(im2, (0, 0))
+
++ @pytest.mark.parametrize(
++ "box",
++ (
++ (2**31 - 1, 0, -(2**31), 1),
++ (0, 2**31 - 1, 1, -(2**31)),
++ ),
++ )
++ def test_overflow(self, box: tuple[int, int, int, int]) -> None:
++ im = Image.new("1", (1, 1))
++ im.paste(1, box)
++
++ with pytest.raises(ValueError, match="images do not match"):
++ im.paste(im.copy(), box)
++
+ def test_incorrect_abbreviated_form(self) -> None:
+ im = Image.new("L", (1, 1))
+ with pytest.raises(ValueError):
+diff --git a/src/libImaging/Paste.c b/src/libImaging/Paste.c
+index f4b72c5d8..bf72d3a1c 100644
+--- a/src/libImaging/Paste.c
++++ b/src/libImaging/Paste.c
+@@ -274,7 +274,7 @@ int
+ ImagingPaste(
+ Imaging imOut, Imaging imIn, Imaging imMask, int dx0, int dy0, int dx1, int dy1
+ ) {
+- int xsize, ysize;
++ int64_t xsize, ysize;
+ int pixelsize;
+ int sx0, sy0;
+ ImagingSectionCookie cookie;
+@@ -286,8 +286,8 @@ ImagingPaste(
+
+ pixelsize = imOut->pixelsize;
+
+- xsize = dx1 - dx0;
+- ysize = dy1 - dy0;
++ xsize = (int64_t)dx1 - dx0;
++ ysize = (int64_t)dy1 - dy0;
+
+ if (xsize != imIn->xsize || ysize != imIn->ysize || pixelsize != imIn->pixelsize) {
+ (void)ImagingError_Mismatch();
+@@ -598,7 +598,7 @@ ImagingFill2(
+ Imaging imOut, const void *ink, Imaging imMask, int dx0, int dy0, int dx1, int dy1
+ ) {
+ ImagingSectionCookie cookie;
+- int xsize, ysize;
++ int64_t xsize, ysize;
+ int pixelsize;
+ int sx0, sy0;
+
+@@ -609,8 +609,8 @@ ImagingFill2(
+
+ pixelsize = imOut->pixelsize;
+
+- xsize = dx1 - dx0;
+- ysize = dy1 - dy0;
++ xsize = (int64_t)dx1 - dx0;
++ ysize = (int64_t)dy1 - dy0;
+
+ if (imMask && (xsize != imMask->xsize || ysize != imMask->ysize)) {
+ (void)ImagingError_Mismatch();
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
file://CVE-2026-55380.patch \
file://CVE-2026-59197.patch \
file://CVE-2026-59198.patch \
+ file://CVE-2026-59199.patch \
"
SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-pillow/CVE-2026-59199.patch | 84 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 85 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch