psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

SummaryPSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

psdtojpg (0.1.0) potentially affected by CVE-2026-59991 via psd-tools (0.10.0)

psd-tools PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on psd-tools and may be impacted: - psdtojpg 0.1.0 Source cves: CVE-2026-59991 Source advisory: OSV:PYSEC-2026-4139...

PYSEC-2026-4139 psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

PT-2026-105888

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

Linux Distros Unpatched Vulnerability : CVE-2026-59991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from...

CVE-2026-59991

creationtimestamp| type| source ---|---|--- 2026-09-22 20:35:10+00:00| published-proof-of-concept| https://github.com/psd-tools/psd-tools/security/advisories/GHSA-8q6g-vjhf-jp8m...

DEBIAN-CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

UBUNTU-CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

agkit (0.27.0), aoirint-psdlayer2dirpy (>=20220819.1.0, <=20220819.2.0) +4 more potentially affected by CVE-2026-59991 via psd-tools (>=1.4.0, <=1.10.9)

psd-tools PYPI version =1.4.0, =20220819.1.0, =2.0.0, =0.8.0, =0.1.0, =0.5.1 Source cves: CVE-2026-59991 Source advisory: OSV:GHSA-8Q6G-VJHF-JP8M...

GHSA-8Q6G-VJHF-JP8M psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

EUVD-2026-84808

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991

The psd-tools Python package, used for processing Adobe Photoshop PSD files, contains an uncontrolled memory allocation vulnerability in the PSDImage.composite() and PSDImage.numpy() functions. Prior to version 1.17.4 , the software allocated output buffers based on attacker-controlled header geo...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991: Memory Allocation with Excessive Size Value

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...