new file mode 100644
@@ -0,0 +1,82 @@
+From 9ce0814ba3aec3d4ba57f15593ebe063bf5ea205 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Tue, 30 Jun 2026 09:17:05 +1000
+Subject: [PATCH] Add max_length to PdfStream decode() (#9718)
+
+CVE: CVE-2026-59200
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09]
+
+(cherry picked from commit f7a31ea75e460e108c37126da1f47812f21f6b09)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_pdfparser.py | 11 +++++++++++
+ src/PIL/PdfParser.py | 15 +++++++++------
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/Tests/test_pdfparser.py b/Tests/test_pdfparser.py
+index cba6cd053..4c522eb7a 100644
+--- a/Tests/test_pdfparser.py
++++ b/Tests/test_pdfparser.py
+@@ -1,6 +1,7 @@
+ from __future__ import annotations
+
+ import time
++import zlib
+
+ import pytest
+
+@@ -95,6 +96,16 @@ def test_parsing() -> None:
+ assert time.strftime("%Y%m%d%H%M%S", getattr(d, name)) == value
+
+
++def test_pdfstream_flatedecode() -> None:
++ d = PdfDict({b"Filter": b"FlateDecode"})
++ buf = zlib.compress(b"test")
++ s = PdfStream(d, buf)
++ assert s.decode() == b"test"
++
++ with pytest.raises(ValueError, match="Decompressed data too large"):
++ s.decode(3)
++
++
+ def test_pdf_repr() -> None:
+ assert bytes(IndirectReference(1, 2)) == b"1 2 R"
+ assert bytes(IndirectObjectDef(*IndirectReference(1, 2))) == b"1 2 obj"
+diff --git a/src/PIL/PdfParser.py b/src/PIL/PdfParser.py
+index f7f3a4643..10079ac66 100644
+--- a/src/PIL/PdfParser.py
++++ b/src/PIL/PdfParser.py
+@@ -10,6 +10,8 @@ import time
+ import zlib
+ from typing import Any, NamedTuple
+
++from . import ImageFile
++
+ TYPE_CHECKING = False
+ if TYPE_CHECKING:
+ from typing import IO
+@@ -320,17 +322,18 @@ class PdfStream:
+ self.dictionary = dictionary
+ self.buf = buf
+
+- def decode(self) -> bytes:
++ def decode(self, max_length: int = ImageFile.SAFEBLOCK) -> bytes:
+ try:
+ filter = self.dictionary[b"Filter"]
+ except KeyError:
+ return self.buf
+ if filter == b"FlateDecode":
+- try:
+- expected_length = self.dictionary[b"DL"]
+- except KeyError:
+- expected_length = self.dictionary[b"Length"]
+- return zlib.decompress(self.buf, bufsize=int(expected_length))
++ dobj = zlib.decompressobj()
++ plaintext = dobj.decompress(self.buf, max_length)
++ if dobj.unconsumed_tail:
++ msg = "Decompressed data too large"
++ raise ValueError(msg)
++ return plaintext
+ else:
+ msg = f"stream filter {repr(filter)} unknown/unsupported"
+ raise NotImplementedError(msg)
@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
file://CVE-2026-59197.patch \
file://CVE-2026-59198.patch \
file://CVE-2026-59199.patch \
+ file://CVE-2026-59200.patch \
"
SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-pillow/CVE-2026-59200.patch | 82 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 83 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59200.patch