CVE-2026-27809

Katalog CVE

CVSS 9.1 · Critical EPSS 0,69%

Kerentanan Integer Overflow or Wraparound pada psd-tools project psd-tools. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-617: Reachable Assertion
CWE-704: Incorrect Type Conversion or Cast
CWE-755: Improper Handling of Exceptional Conditions
CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/psd-tools/psd-tools/security/advisories/GHSA-24p2-j2jr-386w exploit · advisory vendor
• https://github.com/psd-tools/psd-tools/commit/6c0a78f195b5942757886a1863793fd5946c1fb1 patch
• https://github.com/psd-tools/psd-tools/releases/tag/v1.12.2 product · release notes