CVE-2026-59991: psd-tools Memory Allocation Vulnerability via Crafted PSD Geometry
Summary
CVE-2026-59991: psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry. Affects psd-tools versions < 1.17.4. Fixed in 1.17.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
psd-tools is a Python library designed for reading and manipulating Adobe Photoshop PSD files. It provides functionalities such as opening PSD files, accessing layers, and compositing images. The library is widely used in applications that require image processing and manipulation. However, a critical vulnerability has been identified in version 1.17.2, which allows for uncontrolled memory allocation when processing specially crafted PSD files.
Vulnerability Detail
The vulnerability arises from the PSDImage.composite() and .numpy() methods, which allocate memory for the output image based on the dimensions declared in the PSD file's header. These methods do not validate the declared dimensions against the actual file contents, leading to potential multi-gigabyte memory allocations from a small input file. For instance, a 49-byte PSD file can cause composite() to allocate approximately 3 GB of memory, and .numpy() can reach around 7.5 GB. This unchecked allocation can result in denial of service (DoS) attacks, particularly on systems with limited RAM, as the allocation may lead to out-of-memory (OOM) conditions without raising exceptions.
How To Fix
Latest published version: 1.26.0 as of 23 Oct 2026
pip install --upgrade "psd-tools==1.26.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17.4
This is the first release that contains the fix.
pip install --upgrade "psd-tools==1.17.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted PSD files with the composite() or .numpy() methods until the package is updated. Additionally, implement checks in your application to validate the dimensions of PSD files before processing them.
Conclusion
The psd-tools library has a critical vulnerability (CVE-2026-59991) that allows for uncontrolled memory allocation, potentially leading to denial of service. Users are advised to update to version 1.17.4 or later to mitigate this risk. Until then, it is essential to avoid processing untrusted PSD files and implement necessary validation checks.
See every vulnerability recorded for psd-tools →
FAQ
CVE-2026-59991 is a vulnerability in the psd-tools library that allows for uncontrolled memory allocation when processing crafted PSD files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The primary risk is denial of service (DoS) due to excessive memory allocation, which can crash applications or services that process untrusted PSD files.
You can update the psd-tools package by running the command: pip install --upgrade psd-tools in your terminal.
If you cannot update the package, avoid processing untrusted PSD files and implement validation checks for file dimensions before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for psd-tools.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
