diff --git a/pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch b/pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch
new file mode 100644
index 000000000000..76e57ae84f53
--- /dev/null
+++ b/pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch
@@ -0,0 +1,32 @@
+diff --git a/src-tauri/src/lut_processing.rs b/src-tauri/src/lut_processing.rs
+index 5bfbb5b9..51db4bab 100644
+--- a/src-tauri/src/lut_processing.rs
++++ b/src-tauri/src/lut_processing.rs
+@@ -187,6 +187,26 @@ fn parse_hald(image: DynamicImage) -> Result<Lut> {
+ }
+ 
+ pub fn parse_lut_file(path_str: &str) -> Result<Lut> {
++    if path_str.starts_with(r"\\") || path_str.starts_with("//") {
++        return Err(anyhow!("Network paths (UNC) are not allowed for LUTs"));
++    }
++
++    if path_str.contains("..") {
++        return Err(anyhow!("Directory traversal (..) is not allowed"));
++    }
++
++    let path = std::path::Path::new(path_str);
++    if let Some(std::path::Component::Prefix(prefix)) = path.components().next() {
++        match prefix.kind() {
++            std::path::Prefix::UNC(_, _)
++            | std::path::Prefix::VerbatimUNC(_, _)
++            | std::path::Prefix::DeviceNS(_) => {
++                return Err(anyhow!("Device/UNC prefix paths are not allowed"));
++            }
++            _ => {}
++        }
++    }
++
+     let (extension, bytes): (String, Option<Vec<u8>>) =
+         if cfg!(target_os = "android") && is_android_content_uri(path_str) {
+             #[cfg(target_os = "android")]
+
diff --git a/pkgs/by-name/ra/rapidraw/package.nix b/pkgs/by-name/ra/rapidraw/package.nix
index b5028b7c7a56..0a17e24b9def 100644
--- a/pkgs/by-name/ra/rapidraw/package.nix
+++ b/pkgs/by-name/ra/rapidraw/package.nix
@@ -58,6 +58,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-JtkzeCt21KIEshvoCHWo1QoxUgvVJN1loJrUHgvV4qE=";
   };
 
+  patches = [
+    # Patch CVE-2026-64816
+    ./fix-cve-2026-64816.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     makeWrapper