CVE-2026-27809: psd-tools Compression Module Vulnerability Leading to Memory Exhaustion and Integrity Issues
Summary
CVE-2026-27809: A security review of the psd_tools.compression module (conducted against the fix/invalid-rle-compression branch, commits 7490ffa–2a006f5) identified the following pre-existing issues. Affects psd-tools versions < 1.12.2. Fixed in 1.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
psd-tools is a Python library designed for reading and writing Adobe Photoshop PSD files. It provides functionalities for manipulating PSD files, including handling layers, channels, and image data. However, the library has been found to have vulnerabilities in its compression module, particularly in how it handles zlib decompression and image dimension validation, making it susceptible to denial-of-service attacks and data integrity issues.
Vulnerability Detail
The vulnerability arises from multiple issues within the psd-tools compression module. Firstly, the unguarded use of zlib.decompress allows for potential ZIP bomb attacks, where a crafted PSD file could lead to excessive memory consumption, resulting in a denial-of-service condition. Secondly, the lack of validation for image dimensions before memory allocation can lead to attempts to allocate unmanageable amounts of memory, causing crashes. Additionally, the use of assert statements for runtime checks can be disabled, leading to silent failures. These vulnerabilities could be exploited by an attacker to disrupt service or corrupt data.
How To Fix
Minimum fixed version
1.12.2
This is the first release that contains the fix.
pip install --upgrade "psd-tools==1.12.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement checks in your code to validate the dimensions of images before processing them. For example, you can add the following code snippet before calling the decompression function:
if width > 300000 or height > 300000: raise ValueError('Image dimensions exceed maximum allowed limits.')
Conclusion
The psd-tools library has a significant vulnerability (CVE-2026-27809) in its compression module that can lead to memory exhaustion and integrity issues. It is crucial for users to update to the patched version and implement necessary validation checks to safeguard their applications against potential attacks.
See every vulnerability recorded for psd-tools →
FAQ
CVE-2026-27809 is a vulnerability in the psd-tools library that affects its compression module, leading to potential memory exhaustion and integrity issues.
Exploiting this vulnerability can lead to denial-of-service attacks, where an attacker can cause your application to crash or behave unpredictably by providing specially crafted PSD files.
You should update to version 1.12.2 or later to mitigate the vulnerabilities. Use the command 'pip install --upgrade psd-tools' to update.
Yes, you can implement dimension validation checks in your code to prevent processing overly large images until you can update the library.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software without requiring access to the code. You can also check your application against vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for psd-tools.
