diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch
new file mode 100644
index 0000000000..4418b73e99
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch
@@ -0,0 +1,84 @@
+From 0d706085cfb87ffac6eea54f1a42ce8bd3f16513 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Mon, 22 Jun 2026 12:56:41 +1000
+Subject: [PATCH] Use int64_t to calculate paste box dimensions (#9703)
+
+CVE: CVE-2026-59199
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b]
+
+(cherry picked from commit ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_image_paste.py | 14 ++++++++++++++
+ src/libImaging/Paste.c    | 12 ++++++------
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/Tests/test_image_paste.py b/Tests/test_image_paste.py
+index 37e4df103..f9b72e46f 100644
+--- a/Tests/test_image_paste.py
++++ b/Tests/test_image_paste.py
+@@ -357,6 +357,20 @@ class TestImagingPaste:
+         im.copy().paste(im2)
+         im.copy().paste(im2, (0, 0))
+ 
++    @pytest.mark.parametrize(
++        "box",
++        (
++            (2**31 - 1, 0, -(2**31), 1),
++            (0, 2**31 - 1, 1, -(2**31)),
++        ),
++    )
++    def test_overflow(self, box: tuple[int, int, int, int]) -> None:
++        im = Image.new("1", (1, 1))
++        im.paste(1, box)
++
++        with pytest.raises(ValueError, match="images do not match"):
++            im.paste(im.copy(), box)
++
+     def test_incorrect_abbreviated_form(self) -> None:
+         im = Image.new("L", (1, 1))
+         with pytest.raises(ValueError):
+diff --git a/src/libImaging/Paste.c b/src/libImaging/Paste.c
+index f4b72c5d8..bf72d3a1c 100644
+--- a/src/libImaging/Paste.c
++++ b/src/libImaging/Paste.c
+@@ -274,7 +274,7 @@ int
+ ImagingPaste(
+     Imaging imOut, Imaging imIn, Imaging imMask, int dx0, int dy0, int dx1, int dy1
+ ) {
+-    int xsize, ysize;
++    int64_t xsize, ysize;
+     int pixelsize;
+     int sx0, sy0;
+     ImagingSectionCookie cookie;
+@@ -286,8 +286,8 @@ ImagingPaste(
+ 
+     pixelsize = imOut->pixelsize;
+ 
+-    xsize = dx1 - dx0;
+-    ysize = dy1 - dy0;
++    xsize = (int64_t)dx1 - dx0;
++    ysize = (int64_t)dy1 - dy0;
+ 
+     if (xsize != imIn->xsize || ysize != imIn->ysize || pixelsize != imIn->pixelsize) {
+         (void)ImagingError_Mismatch();
+@@ -598,7 +598,7 @@ ImagingFill2(
+     Imaging imOut, const void *ink, Imaging imMask, int dx0, int dy0, int dx1, int dy1
+ ) {
+     ImagingSectionCookie cookie;
+-    int xsize, ysize;
++    int64_t xsize, ysize;
+     int pixelsize;
+     int sx0, sy0;
+ 
+@@ -609,8 +609,8 @@ ImagingFill2(
+ 
+     pixelsize = imOut->pixelsize;
+ 
+-    xsize = dx1 - dx0;
+-    ysize = dy1 - dy0;
++    xsize = (int64_t)dx1 - dx0;
++    ysize = (int64_t)dy1 - dy0;
+ 
+     if (imMask && (xsize != imMask->xsize || ysize != imMask->ysize)) {
+         (void)ImagingError_Mismatch();
diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
index 331b99622b..5acd020d8f 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-55380.patch \
            file://CVE-2026-59197.patch \
            file://CVE-2026-59198.patch \
+           file://CVE-2026-59199.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"