new file mode 100644
@@ -0,0 +1,66 @@
+From a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Sat, 20 Jun 2026 21:18:14 +1000
+Subject: [PATCH] Raise error if image modes do not match ImageCms transform
+ modes (#9715)
+
+CVE: CVE-2026-59205
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721]
+
+(cherry picked from commit 066e349b8e20f6e0400683ff988ac72eea24c049)
+(cherry picked from commit 7f6e9d696913bba9fd1a6cf0b53f4a313dc25329)
+(cherry picked from commit 642d806703c62d4160f3eb8ff25fb63cbedadd98)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_imagecms.py | 4 ++++
+ src/PIL/ImageCms.py | 16 +++++++++-------
+ 2 files changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/Tests/test_imagecms.py b/Tests/test_imagecms.py
+index d73ab34282b..3382a34e47c 100644
+--- a/Tests/test_imagecms.py
++++ b/Tests/test_imagecms.py
+@@ -196,6 +196,10 @@ def test_exceptions() -> None:
+ psRGB = ImageCms.createProfile("sRGB")
+ pLab = ImageCms.createProfile("LAB")
+ t = ImageCms.buildTransform(pLab, psRGB, "LAB", "RGB")
++ with pytest.raises(ValueError, match="mode mismatch"):
++ t.apply(hopper("RGBA"))
++ with pytest.raises(ValueError, match="mode mismatch"):
++ t.apply(hopper("LAB"), hopper("RGBA"))
+ with pytest.raises(ValueError, match="mode mismatch"):
+ t.apply_in_place(hopper("RGBA"))
+
+diff --git a/src/PIL/ImageCms.py b/src/PIL/ImageCms.py
+index 513e28acf..388a9296f 100644
+--- a/src/PIL/ImageCms.py
++++ b/src/PIL/ImageCms.py
+@@ -317,19 +317,21 @@ class ImageCmsTransform(Image.ImagePointHandler):
+ return self.apply(im)
+
+ def apply(self, im: Image.Image, imOut: Image.Image | None = None) -> Image.Image:
+- if imOut is None:
++ if im.mode != self.input_mode:
++ msg = "mode mismatch"
++ raise ValueError(msg)
++ if imOut is not None:
++ if imOut.mode != self.output_mode:
++ msg = "mode mismatch"
++ raise ValueError(msg)
++ else:
+ imOut = Image.new(self.output_mode, im.size, None)
+ self.transform.apply(im.getim(), imOut.getim())
+ imOut.info["icc_profile"] = self.output_profile.tobytes()
+ return imOut
+
+ def apply_in_place(self, im: Image.Image) -> Image.Image:
+- if im.mode != self.output_mode:
+- msg = "mode mismatch"
+- raise ValueError(msg) # wrong output mode
+- self.transform.apply(im.getim(), im.getim())
+- im.info["icc_profile"] = self.output_profile.tobytes()
+- return im
++ return self.apply(im, im)
+
+
+ def get_display_profile(handle: SupportsInt | None = None) -> ImageCmsProfile | None:
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
file://CVE-2026-59199.patch \
file://CVE-2026-59200.patch \
file://CVE-2026-59203.patch \
+ file://CVE-2026-59205.patch \
"
SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-pillow/CVE-2026-59205.patch | 66 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch