Executive brief
psd-tools is a Python library for reading and manipulating Adobe Photoshop PSD files. A buffer overflow vulnerability in its Cython-based RLE (Run-Length Encoding) decoder allows an attacker to crash the application or potentially execute arbitrary code by providing a malformed PSD file. This affects any application that processes untrusted PSD files.
Technical details
The vulnerability is a buffer overflow in the Cython implementation of RLE decoding that fails to validate input data when decoding to PIL.Image or NumPy format. The root cause is improper checking for unusual or exceptional conditions (CWE-754) during RLE decompression. An attacker can craft a malformed PSD file with invalid RLE encoding that triggers the overflow when processed by psd-tools. No authentication or user interaction is required—the vulnerability is triggered simply by loading a malicious PSD file over the network. The impact includes memory corruption leading to denial of service or arbitrary code execution. The vulnerability is patched in version 1.9.4; users of versions 1.8.37 through 1.9.3 should upgrade immediately.
Affected products
- psd-tools psd-tools 1.8.37 to 1.9.3
Timeline
- 2020-03-16: disclosed
- 2020-03-16: patched: Version 1.9.4 released