CVE-2026-27809: psd-tools DoS Vulnerability in Python

CVE-2026-27809 Overview

CVE-2026-27809 is a denial of service vulnerability in psd-tools, a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g., a literal run that extends past the expected row size), the decode_rle() function raises a ValueError that propagates all the way to the user, crashing psd.composite() and psd-tools export operations. This vulnerability allows attackers to craft malicious PSD files that can crash applications relying on this library.

Critical Impact

Applications processing user-supplied PSD files are vulnerable to denial of service attacks through malformed RLE-compressed image data, causing unhandled exceptions and application crashes.

Affected Products

• psd-tools versions prior to 1.12.2
• Applications using psd-tools for PSD file processing
• Python-based image processing pipelines handling Photoshop files

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27809 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27809

Vulnerability Analysis

This vulnerability stems from improper exception handling in the RLE (Run-Length Encoding) decompression routine. When processing PSD files with malformed RLE-compressed image data, specifically when a literal run extends beyond the expected row size, the decode_rle() function throws a ValueError. The decompress() function already had a fallback mechanism designed to replace failed channels with black pixels when the result is None, but this fallback never triggered because the ValueError from decode_rle() was not caught.

The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound), as the boundary condition error in processing RLE data can lead to unexpected behavior when handling malformed compression headers that specify incorrect data lengths.

Root Cause

The root cause is insufficient exception handling in the decompression pipeline. The existing fallback mechanism that replaces failed channels with black pixels was designed to handle None results, but the code path for ValueError exceptions was not covered. This meant that any malformed RLE data that caused decode_rle() to raise an exception would crash the entire application rather than gracefully degrading to the fallback behavior.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious PSD file with intentionally malformed RLE-compressed image data. When a victim application processes this file using psd-tools, the following sequence occurs:

1. The application loads the malicious PSD file using psd-tools
2. During image compositing or export, the library attempts to decompress RLE-encoded channels
3. The malformed RLE data causes decode_rle() to encounter a boundary condition error
4. A ValueError is raised and propagates up the call stack
5. The application crashes without proper error handling

The fix in version 1.12.2 wraps the decode_rle() call in a try/except block so the existing fallback handles the error gracefully by replacing the corrupted channel with black pixels.

# Security patch in src/psd_tools/__init__.py - Fix compression security issues (GHSA-24p2-j2jr-386w) (#549)

from psd_tools.api.psd_image import PSDImage
from psd_tools.compression import PSDDecompressionWarning
from psd_tools.version import __version__

__all__ = ["PSDImage", "PSDDecompressionWarning", "__version__"]

Source: GitHub Commit Details

The patch also introduces PSDDecompressionWarning to provide applications with visibility into decompression failures without crashing.

Detection Methods for CVE-2026-27809

Indicators of Compromise

• Application logs showing ValueError exceptions originating from decode_rle() function
• Unexpected crashes in Python applications during PSD file processing
• Error messages referencing RLE decompression failures in psd-tools stack traces

Detection Strategies

• Monitor application logs for unhandled ValueError exceptions during PSD file operations
• Implement file integrity checks for PSD files before processing to identify potentially malformed compression headers
• Deploy application crash monitoring to detect denial of service attempts targeting file processing functionality
• Check installed psd-tools package version using pip show psd-tools to identify vulnerable installations

Monitoring Recommendations

• Enable verbose logging for image processing pipelines to capture decompression warnings and errors
• Set up alerting for repeated crashes in file processing services handling user-uploaded PSD files
• Monitor for the new PSDDecompressionWarning after upgrading to help identify potentially malicious files

How to Mitigate CVE-2026-27809

Immediate Actions Required

• Upgrade psd-tools to version 1.12.2 or later immediately using pip install --upgrade psd-tools
• Review application code to ensure proper exception handling around PSD file processing operations
• Implement input validation and file scanning for user-uploaded PSD files
• Consider sandboxing PSD processing operations to limit crash impact

Patch Information

The vulnerability is fixed in psd-tools version 1.12.2. The patch wraps the decode_rle() call in a try/except block, allowing the existing fallback mechanism to handle decompression errors gracefully by replacing failed channels with black pixels. For detailed patch information, see the GitHub Security Advisory GHSA-24p2-j2jr-386w and the GitHub Release v1.12.2.

Workarounds

• Wrap all psd-tools operations in application-level try/except blocks to prevent crashes from propagating
• Implement a file validation layer that rejects PSD files with suspicious compression characteristics before processing
• Run PSD processing in isolated worker processes that can be safely restarted after crashes

# Configuration example
# Upgrade psd-tools to patched version
pip install --upgrade psd-tools>=1.12.2

# Verify installed version
pip show psd-tools | grep Version

# Update project dependencies
pip install "cython>=3.2.4" "setuptools>=82.0.0"