CVE-2026-27809 psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
A malicious PSD file can cause a crash in psd-tools due to unhandled exceptions during RLE decompression, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27809?
CVE-2026-27809 is a medium-severity denial of service vulnerability in psd-tools, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.
Weakness: CWE-789, CWE-755, CWE-704, CWE-617, CWE-409, CWE-190
Which versions are affected by CVE-2026-27809?
3 open source packages ship an affected version, including psd-tools. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
psd-tools PyPI | All versions | 1.12.2 |
psd-tools PyPI | All versions | 1.12.2 |
psd-tools PyPI | All versions | 1.12.2 |
Products include Psd-Tools Project Psd-Tools.
How do I fix CVE-2026-27809?
Upgrade psd-tools to 1.12.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27809 being exploited?
There is no known exploitation of CVE-2026-27809 in the wild and no public exploit code.
Other vulnerabilities in psd-tools
Sources
Also known as DEBIAN-CVE-2026-27809, GHSA-24p2-j2jr-386w, PYSEC-2026-2262, UBUNTU-CVE-2026-27809.