Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-27809
February 25, 2026
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.
Affected Packages
https://github.com/psd-tools/psd-tools.git (GITHUB):
Affected version(s) >=v1.8.26 <v1.12.2
Fix Suggestion:
Update to version v1.12.2
psd-tools (PYTHON):
Affected version(s) >=0.1.1 <1.12.2
Fix Suggestion:
Update to version 1.12.2
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.8
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
UNREPORTED
CVSS v3
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Memory Allocation with Excessive Size Value
Improper Handling of Highly Compressed Data (Data Amplification)
Incorrect Type Conversion or Cast
Integer Overflow or Wraparound
Improper Handling of Exceptional Conditions
Reachable Assertion
EPSS
Base Score:
0.05