psd-tools up to 1.12.1 PSD File Parser decode_rle data amplification

Summaryinfo

A vulnerability has been found in psd-tools up to 1.12.1 and classified as problematic. This affects the function decode_rle of the component PSD File Parser. The manipulation leads to data amplification. This vulnerability is documented as CVE-2026-27809. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in psd-tools up to 1.12.1. This issue affects the function decode_rle of the component PSD File Parser. The manipulation with an unknown input leads to a data amplification vulnerability. Using CWE to declare the problem leads to CWE-409. The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. Impacted is availability. The summary by CVE is:

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-27809 since 02/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 300480 (Linux Distros Unpatched Vulnerability : CVE-2026-27809), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.12.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (300480) and EUVD (EUVD-2026-8781). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• psd-tools

Version

• 1.12.0
• 1.12.1

Website

• Product: https://github.com/psd-tools/psd-tools/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion