CVE-2026-59991

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59991
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59991.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59991
Aliases
Downstream
Published
2026-09-22T19:11:38Z
Modified
2026-10-28T02:30:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
Details

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59991.json"
}
References

Affected packages

Git / github.com/psd-tools/psd-tools

Affected ranges

Type
GIT
Repo
https://github.com/psd-tools/psd-tools
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ee32bce3bc2ff1f190a815ed55b518adb791de89
Fixed
a3d9a53ad51e667b5772a4f636ca6f2e16f4b271
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.17.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "a3d9a53ad51e667b5772a4f636ca6f2e16f4b271"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.17.4",
            "range": [
                {
                    "fixed": "ee32bce3bc2ff1f190a815ed55b518adb791de89"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1
0.1.1
0.1.2
0.1.3
0.1.4
0.10
0.2
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.8.2
0.8.3
0.8.4
0.9
0.9.1
1.*
1.0
1.1
1.2
1.3
1.4
1.8.10
1.8.11
1.8.12
1.8.14
1.8.17
1.8.21
1.8.25
1.8.26
1.8.8
1.8.9
v.*
v.1.9.0
v1.*
v1.10.0
v1.10.1
v1.10.10
v1.10.11
v1.10.12
v1.10.13
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.7
v1.10.8
v1.10.9
v1.11.0
v1.11.1
v1.12.0
v1.12.1
v1.13.1
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.15.0
v1.15.0.post1
v1.16.0
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.8.26
v1.8.27
v1.8.28
v1.8.29
v1.8.30
v1.8.31
v1.8.32
v1.8.33
v1.8.34
v1.8.35
v1.8.36
v1.8.37.post1
v1.8.37.post2
v1.8.37.post3
v1.8.38
v1.9.1
v1.9.10
v1.9.11
v1.9.12
v1.9.13
v1.9.14
v1.9.15
v1.9.16
v1.9.17
v1.9.18
v1.9.19
v1.9.2
v1.9.20
v1.9.21
v1.9.22
v1.9.23
v1.9.24
v1.9.25
v1.9.26
v1.9.27
v1.9.28
v1.9.29
v1.9.3
v1.9.30
v1.9.31
v1.9.32
v1.9.33
v1.9.34
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59991.json"