Read the docs
TI-2026-42775 Aliases CVE-2026-59991GHSA-8q6g-vjhf-jp8m

psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

Priority HIGH 72CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00517 44th percentileScored 2026-11-07
Fix Fixed psd-tools (psd-tools): 1.17.4psd-tools (PyPI): 1.17.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
psd-toolspsd-toolsbefore 1.17.41.17.4Patch availableCNA
—psd-tools (PyPI)before 1.17.41.17.4Patch availableGHSA-8q6g-vjhf-jp8m
  • psd-tools Vendorpsd-tools Affected before 1.17.4 Fixed in 1.17.4 Patch available CNA
  • psd-tools (PyPI) Vendor— Affected before 1.17.4 Fixed in 1.17.4 Patch available GHSA-8q6g-vjhf-jp8m

Remediation

  • Fix · CNA psd-tools (psd-tools) Fixed in 1.17.4
  • Fix · GHSA-8q6g-vjhf-jp8m psd-tools (PyPI) Fixed in 1.17.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59991
  2. 2026-10-03 Alias added: GHSA-8q6g-vjhf-jp8m

References

Other 4

  • TI-2026-36740 psd-tools: arbitrary file write via smart-object filename CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences