CVE-2026-63501
Received Received - Intake

Memory Exhaustion in ag-psd Library

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63501
EUVD
EUVD-2026-116262

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Agamnentzar ag-psd < 31.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the ag-psd JavaScript library used for reading and writing Photoshop Document files. It allows an attacker to supply a PSD file with malicious layer dimensions that bypass memory limits, causing excessive memory allocation and process crashes. The issue stems from inconsistent parameter naming between readPsd() and decodeLayerImageData functions, leading to undefined memory limits during image data processing.

Impact Analysis

If you use the ag-psd library in your application, an attacker could exploit this vulnerability by providing a specially crafted PSD file. This would cause your application to consume excessive memory, potentially leading to crashes or denial of service. The vulnerability affects applications that parse untrusted PSD files with layer decoding enabled.

Mitigation Strategies

Update ag-psd to version 31.0.1 or later to address the memory exhaustion and denial of service issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...