Due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply.
{
"github_reviewed_at": "2026-05-18T17:53:18Z",
"github_reviewed": true,
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"nvd_published_at": null,
"severity": "MODERATE"
}