https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 02:28:38 +0000 https://db.gcve.eu/vuln/cve-2026-59991 <p><strong>Affected:</strong> psd-tools</p> <p>psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.</p> <p><strong>Affected:</strong> psd-tools</p> <p>psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.</p> https://db.gcve.eu/vuln/cve-2026-59991 https://db.gcve.eu/vuln/pysec-2026-4139 <p><strong>Affected:</strong> PyPI: psd-tools</p> <p>### Summary `PSDImage.composite()` (and `.numpy()`) allocate the output image buffer from the PSD&#39;s header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, `composite()` then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.</p> <p>### Impact On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes `composite()` commit ~3 GB and return successfully (warning only); `.numpy()` reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.</p> <p>### Steps to reproduce ```python # pip install psd-tools==1.17.2 from psd_tools import PSDImage psd = PSDImage.open(&#34;psd-psdtools-grammar-d23.psd&#34;) psd.composite() # commits ~3 GB from a 49-byte file and returns (warning only) ```</p> <p>PoC (49 bytes), reconstruct with: ```sh base64 -d &gt; psd-psdtools-grammar-d23.psd &lt;&lt;&#39;EOF&#39; OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw== EOF ``` Verify: ``` 7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd…</p> <p><strong>Affected:</strong> PyPI: psd-tools</p> <p>### Summary `PSDImage.composite()` (and `.numpy()`) allocate the output image buffer from the PSD&#39;s header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, `composite()` then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.</p> <p>### Impact On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes `composite()` commit ~3 GB and return successfully (warning only); `.numpy()` reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.</p> <p>### Steps to reproduce ```python # pip install psd-tools==1.17.2 from psd_tools import PSDImage psd = PSDImage.open(&#34;psd-psdtools-grammar-d23.psd&#34;) psd.composite() # commits ~3 GB from a 49-byte file and returns (warning only) ```</p> <p>PoC (49 bytes), reconstruct with: ```sh base64 -d &gt; psd-psdtools-grammar-d23.psd &lt;&lt;&#39;EOF&#39; OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw== EOF ``` Verify: ``` 7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd…</p> https://db.gcve.eu/vuln/pysec-2026-4139