CVE-2026-27809: psd-tools compression module unguarded zlib decompression and missing validation

CVE-2026-27809 · Severity: medium · CVSS 4 · Published 2026-02-26

psd-tools is a Python library for reading and writing Adobe Photoshop PSD/PSB files. The compression module has multiple vulnerabilities including unguarded zlib decompression that can be exploited via crafted PSD files to exhaust memory (ZIP bomb), missing validation of image dimensions that can cause uncontrolled memory allocation, and use of assertions as runtime integrity checks which can be disabled in optimized Python deployments. An attacker can cause a denial-of-service crash by providing a malicious PSD file.

Technologies: psd-tools (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27809 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27809 being exploited in the wild.
How severe is CVE-2026-27809?
Medium severity, with a CVSS score of 4, published 26 February 2026.
Which products and versions are affected?
psd-tools (PyPI) ECOSYSTEM:introduced=0,fixed=1.12.2.
Is there a fix for CVE-2026-27809?
Yes. psd-tools (PyPI): upgrade to 1.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27809 attacked?
It is attacked over the network.
Am I affected by CVE-2026-27809?
Check whether you run psd-tools (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • psd-tools (PyPI): upgrade to 1.12.2 or later
    pip install "psd-tools>=1.12.2"

Technical details

The vulnerability consists of multiple security issues in the psd_tools.compression module: (1) Unguarded zlib.decompress() calls without max_length caps allow ZIP bomb attacks—a crafted PSD file with ZIP-compressed channel data can expand to gigabytes, exhausting process memory before any limit is enforced (CWE-409: Improper Resource Validation). (2) Missing upper-bound validation on image dimensions (width, height, depth) before memory allocation allows uncontrolled allocation attempts on malformed PSB files containing dimensions up to 300,000×300,000 pixels, resulting in hard crashes instead of recoverable errors (CWE-190: Integer Overflow). (3) Use of Python assert statements as runtime integrity checks which can be silently disabled when the interpreter runs with -O flags, allowing length mismatches to propagate silently (CWE-390: Detection Using an Incorrect Regular Expression). Additionally, minor type mismatches in Cython code and silent data degradation issues are noted. Patches are available in version 1.12.2, which adds max_length constraints to zlib.decompress() and explicit dimension validation with descriptive error messages.

Affected products

  • psd-tools psd-tools < 1.12.2

Identifiers

  • CVE-2026-27809
  • GHSA-24p2-j2jr-386w
  • PYSEC-2026-2262

Timeline

  • 2026-02-26: disclosed
  • 2026-02-25: patched: Patches available in version 1.12.2 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.