CVE-2026-59991

Received Received - Intake

psd-tools Memory Allocation Vulnerability in PSDImage Composite

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-59991

EUVD

EUVD-2026-84808

Affected Vendors & Products

Vendor	Product	Version / Range
psd-tools	psd-tools	1.17.4
psd-tools	psd-tools	to 1.17.4 (exc)
psd-tools	psd-tools	to 1.17.3 (exc)
psd-tools	psd-tools	to 1.17.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

The vulnerability in psd-tools versions prior to 1.17.4 involves uncontrolled memory allocation in the PSDImage.composite() and PSDImage.numpy() functions. When processing crafted PSD files with excessively large declared dimensions, the library allocates an output image buffer based on the PSD's header geometry without validating these values against the actual file contents. This allows a tiny PSD file to trigger multi-gigabyte memory allocations, potentially causing denial of service by exhausting system resources.

Detection Guidance

Check the installed version of psd-tools using pip show psd-tools. If the version is below 1.17.4, the system is vulnerable. Monitor for unexpected memory spikes or crashes when processing PSD files.

Impact Analysis

If exploited, this vulnerability could allow an attacker to provide a maliciously crafted PSD file to a service that processes untrusted PSDs, leading to unrecoverable out-of-memory conditions on systems with insufficient RAM. Services that composite untrusted PSD files could be terminated by out-of-memory handling.

Compliance Impact

This vulnerability primarily impacts system availability by enabling denial-of-service attacks through excessive memory allocation. While it does not directly expose or leak data, it could disrupt services processing untrusted PSD files, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Organizations must ensure robust input validation and resource limits to maintain compliance.

Mitigation Strategies

Upgrade psd-tools to version 1.17.4 or later. Validate PSD files before processing to ensure they do not contain excessively large dimensions. Implement memory limits or sandboxing for PSD processing services.

Hi! I’m here to help you understand CVE-2026-59991. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70