Denial of Service Vulnerability in ag-psd JavaScript Library for Photoshop Documents
CVE-2026-62297
What is CVE-2026-62297?
The ag-psd JavaScript library, utilized for reading and writing Photoshop Document files, possesses a vulnerability that enables denial of service through excessive memory allocation. Prior to the remediation introduced in version 31.0.0, the readPsd() function mishandled attacker-defined PSD geometries, leading to potential multi-gigabyte memory usage without sufficient validation against actual data limits. An attacker can craft a small PSD declaring massive geometries, which can cause the application to exhaust system memory and terminate abruptly. Although version 31.0.0 implemented a limit on composite-image allocations, further vulnerabilities in the layer-rectangle allocation remain unaddressed, necessitating additional scrutiny and remediation.
Affected Version(s)
ag-psd < 31.0.0