Memory Allocation Vulnerability in psd-tools Python Package for Adobe Photoshop Files

CVE-2026-59991

What is CVE-2026-59991?

The psd-tools package, used for manipulating Adobe Photoshop PSD files, has a vulnerability that allows attackers to exploit unvalidated PSD header data. Specifically, the functions PSDImage.composite() and PSDImage.numpy() fail to properly check the dimensions and data from potentially malicious PSD files. This oversight can lead to excessive memory allocation, potentially consuming a multi-gigabyte buffer if a specially crafted PSD file is processed. As a result, applications that utilize this package for compositing untrusted files may experience unexpected behavior, including service termination due to out-of-memory errors. This issue has been rectified in version 1.17.4, emphasizing the critical need for users to update.

References