Read the docs
TI-2026-22162 Aliases CVE-2026-27809GHSA-24p2-j2jr-386w

psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

Priority LOW 39CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-617.

Summary

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed psd-tools (psd-tools): 1.12.2psd-tools (PyPI): 1.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
psd-toolspsd-toolsbefore 1.12.21.12.2Patch availableCNA
—psd-tools (PyPI)before 1.12.21.12.2Patch availableGHSA-24p2-j2jr-386w
  • psd-tools Vendorpsd-tools Affected before 1.12.2 Fixed in 1.12.2 Patch available CNA
  • psd-tools (PyPI) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-24p2-j2jr-386w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:psd-tools_project:psd-tools:*:*:*:*:*:*:*:*before 1.12.2VulnerablePsd-tools Project
  • cpe:2.3:a:psd-tools_project:psd-tools:*:*:*:*:*:*:*:* Versions before 1.12.2 Vulnerable ·Psd-tools Project

Remediation

  • Fix · CNA psd-tools (psd-tools) Fixed in 1.12.2
  • Fix · GHSA-24p2-j2jr-386w psd-tools (PyPI) Fixed in 1.12.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27809
  2. 2026-10-03 Alias added: GHSA-24p2-j2jr-386w
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-42775 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry CVSS 3.1HIGH 7.5
  • TI-2026-36740 psd-tools: arbitrary file write via smart-object filename CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences