CVE-2026-27809: psd-tools: Unhandled ValueError in PSD RLE Decompression
psd-tools versions before 1.12.2 allow malformed RLE-compressed image data to raise a ValueError that is not caught, so the error reaches the user and can crash psd.composite() and export operations. An existing fallback that replaces failed channels with black pixels was never reached. The fix in 1.12.2 wraps the decoding call in a try/except so that the fallback handles the error.
Overview
psd-tools is a Python package for working with Adobe Photoshop PSD files. According to the advisory data, malformed RLE-compressed image data causes an uncaught ValueError in the decoding path, and an existing fallback that was meant to handle failed channels was never reached. The fix is in version 1.12.2.
Impact
- Confirmed: the error propagates to the user and can crash psd.composite() and psd-tools export operations.
- Confirmed: NVD gives a CVSS base score of 9.1 with high integrity and availability impact and no confidentiality impact in the listed vector.
- Confirmed: GitHub gives a CVSS 4 score of 6.8.
- Inference: a denial of service on processing pipelines that handle untrusted PSD files is the most direct consequence described.
- Unknown: the record lists CWE-190 (Integer Overflow or Wraparound), but the description focuses on an unhandled exception, so the relationship between the CWE and the bug is not explained by the sources.
Affected products and versions
- Psd-tools Psd-tools: before 1.12.2.
- Psd-tools Project Psd-tools: before 1.12.2.
- Fixed version: 1.12.2.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The record reports an SSVC exploitation value of none and an EPSS probability of 0.00768 with a percentile of 0.551. One reference is tagged as Exploit in the record, but that tag does not by itself establish exploitation in the wild.
Remediation and mitigation
- Upgrade psd-tools to version 1.12.2 or later, which contains the fix referenced in the advisory.
- Until the upgrade is applied, treat PSD files from untrusted sources with caution.
- Run composite and export jobs on untrusted files in isolated environments so that a crash does not affect other services.
Detection guidance
- Monitor logs of PSD processing jobs for ValueError exceptions raised from decoding functions and for repeated failures in composite or export tasks.
- Because the fallback replaces failed channels with black pixels, some outputs may contain unexpected black regions instead of an error. Review outputs from untrusted inputs for this pattern.
Limitations of the available information
- The title mentions hardening gaps, but the record does not describe them, so their scope is unknown.
- The record does not state the complete list of versions below 1.12.2 beyond the stated upper bound.
- Whether the GitHub CVSS 4 score or the NVD CVSS score is the primary rating in every context is not stated.
- The sources consulted do not show independent proof-of-concept or real-world attack reports.
Sources: GitHub Security Advisory GHSA-24p2-j2jr-386w, fix commit, release notes, NVD entry.
Frequently asked questions
Which psd-tools versions are affected by CVE-2026-27809?
The record lists psd-tools versions before 1.12.2 as affected. The fix is in version 1.12.2.
Is this vulnerability known to be actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What is the main consequence of the bug?
An uncaught ValueError can propagate to the user and crash composite or export operations, which is a denial-of-service style impact on processing workflows.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.