CVE-2026-59991: psd-tools Uncontrolled Memory Allocation via Crafted PSD Geometry
Summary
CVE-2026-59991: psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry. Affects psd-tools versions < 1.17.4. Fixed in 1.17.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
psd-tools is a Python library designed for reading and manipulating Adobe Photoshop PSD files. It allows users to access and modify layers, channels, and other components of PSD files. The library is widely used in applications that require image processing and manipulation. However, it is vulnerable to a significant issue where it can allocate excessive memory based on unvalidated dimensions declared in the PSD file, leading to potential denial of service.
Vulnerability Detail
The vulnerability arises from the method PSDImage.composite() and its associated numpy() function, which allocate memory for the output image buffer based on the dimensions specified in the PSD file's header. These dimensions are not validated against the actual file contents, allowing an attacker to craft a PSD file with minimal size but large declared dimensions. This results in excessive memory allocation, potentially reaching several gigabytes, which can lead to out-of-memory (OOM) conditions and crash the service processing the PSD file. The issue is exacerbated by the fact that the function returns a black image with only a warning, rather than raising an exception, making it difficult for users to detect the problem.
How To Fix
Latest published version: 1.26.0 as of 23 Oct 2026
pip install --upgrade "psd-tools==1.26.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17.4
This is the first release that contains the fix.
pip install --upgrade "psd-tools==1.17.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted PSD files until the package is updated. Implement additional checks in your application to validate the dimensions of PSD files before passing them to the composite() function.
Conclusion
The psd-tools library has a critical vulnerability (CVE-2026-59991) that allows for uncontrolled memory allocation from crafted PSD files. Users are advised to update to the latest version to mitigate this risk. Additionally, implementing validation checks can help prevent potential denial of service attacks.
See every vulnerability recorded for psd-tools →
FAQ
CVE-2026-59991 is a vulnerability in the psd-tools library that allows for uncontrolled memory allocation based on unvalidated dimensions in crafted PSD files.
The vulnerability can lead to denial of service by causing excessive memory allocation, which may crash the service processing the PSD file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, avoid processing untrusted PSD files and implement checks to validate file dimensions before processing.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for psd-tools.
