CVE-2020-10571: Buffer Overflow in psd-tools
Summary
CVE-2020-10571: Potential buffer overflow in psd-tools. Affects psd-tools versions >= 1.8.37, < 1.9.4. Fixed in 1.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
psd-tools is a Python package available on PyPI that provides tools for working with Adobe Photoshop PSD files. It allows users to read, write, and manipulate PSD files in various formats. The package is widely used in Python applications that require PSD file processing. However, versions prior to 1.9.4 of psd-tools are vulnerable to a buffer overflow issue.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10571, exists in psd-tools versions 1.8.37 to 1.9.3. The issue stems from a lack of proper input validation during RLE decoding in the Cython implementation. As a result, malformed PSD input data can trigger a buffer overflow when decoding to the PIL.Image or NumPy format. This buffer overflow can lead to arbitrary code execution or a denial of service attack. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 1.26.0 as of 23 Oct 2026
pip install --upgrade "psd-tools==1.26.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.4
This is the first release that contains the fix.
pip install --upgrade "psd-tools==1.9.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If Cython is not present during installation, the buffer overflow does not occur. However, it is recommended to upgrade the already installed psd-tools with the Cython extension to the latest version to mitigate any potential risks. The command 'pip install --upgrade psd-tools' can be used to upgrade the package.
Conclusion
In conclusion, psd-tools versions 1.8.37 to 1.9.3 are vulnerable to a buffer overflow issue that can lead to arbitrary code execution or a denial of service attack. Users should upgrade to version 1.9.4 or later to fix the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for psd-tools →
FAQ
psd-tools is a Python package used for working with Adobe Photoshop PSD files. It provides functionality to read, write, and manipulate PSD files in various formats.
The vulnerability allows for a buffer overflow, which can lead to arbitrary code execution or a denial of service attack. It poses a significant risk to applications utilizing psd-tools.
To fix the vulnerability, upgrade psd-tools to version 1.9.4 or later using the command 'pip install --upgrade psd-tools'.
If Cython is not present during installation, the buffer overflow does not occur. However, it is recommended to upgrade the already installed psd-tools with the Cython extension to the latest version.
The vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for psd-tools.
