PT-2026-22058 · Pypi · Psd-Tools

Kyamagup

·

Published

2026-02-25

·

Updated

2026-03-03

·

CVE-2026-27809

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.12.2
Description psd-tools, a Python package for working with Adobe Photoshop PSD files, contains multiple issues. A lack of a length cap on zlib.decompress can lead to denial-of-service or out-of-memory crashes when processing crafted PSD files containing ZIP-compressed channels. There is no upper-bound validation on image dimensions before memory allocation, which could lead to crashes when processing malformed or adversarially crafted PSB files. An assert statement is used as a runtime integrity check, which can be disabled, potentially leading to silent errors. There is a type mismatch between cdef int indices and Py ssize t size in the Cython decoder. Silent data degradation occurs when malformed channel data is replaced with zero-padded pixels, and this is only indicated by a log message. Finally, there is an inconsistency in the return type of the encode() function in the Cython code.
Recommendations Versions prior to 1.12.2 should be updated to version 1.12.2 or later.

Exploit

Fix

Assertion Failure

Integer Overflow

Improper Handling of Exceptional Conditions

Incorrect Type Conversion or Cast

Related Identifiers

CVE-2026-27809
GHSA-24P2-J2JR-386W

Affected Products

Psd-Tools