RLE Compression Flaw in psd-tools Affects Adobe Photoshop File Handling
CVE-2026-27809

6.8MEDIUM

Key Information:

Vendor

Psd-tools

Status
Psd-tools
Vendor
CVE Published:
25 February 2026

What is CVE-2026-27809?

The psd-tools Python package, used for processing Adobe Photoshop PSD files, is susceptible to an improper error handling vulnerability. When decoding RLE-compressed image data within a PSD file, malformed data can cause the decode_rle() function to raise a ValueError. This unhandled exception can lead to crashes during the psd.composite() rendering and export processes. A fix implemented in version 1.12.2 now appropriately wraps the decode_rle() call in a try/except block, allowing for a smoother fallback mechanism that replaces missing channels with black pixels, thus enhancing the robustness of the application.

Affected Version(s)

psd-tools < 1.12.2

References

https://github.com/psd-tools/psd-tools/security/advisorie...
x_refsource_CONFIRM
https://github.com/psd-tools/psd-tools/commit/6c0a78f195b...
x_refsource_MISC
https://github.com/psd-tools/psd-tools/releases/tag/v1.12.2
x_refsource_MISC

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.