cyfenced.com →

[ CVE-2026-59991 · Published 22 Sep 2026 ]

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

CVSS 7.5 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.

[ Fixes ]Fixes and patches

  • psd-tools 1.17.4Fixed version · GitHub Advisories · pip package psd-tools: upgrade to 1.17.4 or later (affected < 1.17.4)

[ Packages ]Affected open-source packages

[ References ]References