CVE-2026-59991: psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
Summary PSDImage.composite() (and .numpy()) allocate the output image buffer from the PSD's header geometry (width × height × channels × depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte allocation. Critically, composite() then returns a (black) image with only a warning, no exception is raised, so a caller cannot detect or guard against it.
Impact On psd-tools 1.17.2 (latest), default usage, a 49-byte PSD makes composite() commit ~3 GB and return successfully (warning only); .numpy() reaches ~7.5 GB, and the per-layer rectangle is a second lever (up to ~32 GB), all from an input under 100 bytes (input-to-commit amplification over 1000×). Because the buffer is committed before validation and no exception is thrown, any service that composites untrusted PSDs is exposed to denial of service: on a host with less RAM than the attacker-declared geometry the allocation is an unrecoverable OOM-kill.
Steps to reproduce python pip install psd-tools==1.17.2 from psdtools import PSDImage psd = PSDImage.open("psd-psdtools-grammar-d23.psd") psd.composite() # commits ~3 GB from a 49-byte file and returns (warning only)
PoC (49 bytes), reconstruct with: sh base64 -d > psd-psdtools-grammar-d23.psd <<'EOF' OEJQUwABAAAAAAAAAAYAACg4AAAXTAAIAAMAAAAAAAAAAAAAAAAAAUNIUIFU+yQtDw== EOF Verify: 7d8ebf03a54393cb0359ecf4b676d1b08c9a8c6afdd06671ef406d6893cce826 psd-psdtools-grammar-d23.psd
Root cause The composite/numpy buffer is sized from the declared image (and per-layer) dimensions and channel/depth without checking them against the available data length or a sane maximum.
Suggested fix Validate the declared dimensions, channel count, and per-layer rectangles against the actual file length (and a configurable maximum pixel/byte budget) before allocating; raise an error on overflow instead of committing the buffer and returning a black image.
Other sources
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/psd-toolsto a version that resolves this vulnerability.Fixed in 1.17.4 - Upgrade
Upgrade
psd-toolsto a version that resolves this vulnerability.Fixed in 1.17.4
Event History
Frequently Asked Questions
Which deployments are exposed to denial of service?
Services that call PSDImage.composite() or PSDImage.numpy() on untrusted PSD files are exposed. A small crafted PSD can request multi-gigabyte output-buffer allocations and cause the service to be terminated by out-of-memory handling.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
What should be done if upgrading cannot happen immediately?
Avoid compositing or converting untrusted PSD files with PSDImage.composite() or PSDImage.numpy(). If those operations must remain available, process untrusted files with memory limits so an excessive allocation cannot exhaust the service host.
How can affected behavior be recognized?
A crafted PSD may trigger unusually large memory allocation or out-of-memory termination during compositing or NumPy conversion. PSDImage.composite() may also return a black image with only a warning rather than raising an exception.
What version fixes the issue?
The issue is fixed in psd-tools version 1.17.4. Versions prior to 1.17.4 are affected.