CVE-2026-59991High· 7.5▾ MidnightPoC availablepsd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
psd-tools < 1.17.4Patched in:
psd-tools 1.17.4Connected by shared product, vendor, weakness, or advisory.
CVE-2020-10571Critical· 9.8Potential buffer overflow in psd-tools
CVE-2026-27809Mediumpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
CVE-2026-49836Medium· 4.6psd-tools is a Python package for working with Adobe Photoshop PSD files
CVE-2026-105749Medium· 6.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-112399High· 7.5Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-107215High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets