Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M
CVE-2026-59991psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
High 7.5
In plain English
A high-severity security flaw in psd-tools from psd-tools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | psd-tools | no fix listed | DEBIAN-CVE-2026-59991 |
| Debian:13 | psd-tools | no fix listed | DEBIAN-CVE-2026-59991 |
| Debian:14 | psd-tools | 1.17.4+dfsg.1-1 | DEBIAN-CVE-2026-59991 |
| PyPI | psd-tools | 1.17.4 | PYSEC-2026-4139 |
| PyPI | psd-tools | 1.17.4 | GHSA-8q6g-vjhf-jp8m |
| Ubuntu:24.04:LTS | psd-tools | no fix listed | UBUNTU-CVE-2026-59991 |
| Ubuntu:26.04:LTS | psd-tools | no fix listed | UBUNTU-CVE-2026-59991 |
| Ubuntu:26.10 | psd-tools | no fix listed | UBUNTU-CVE-2026-59991 |
Affected products (as reported)
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H