Potential buffer overflow in psd-tools
Impact
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.
Patches
Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.
Workarounds
Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.
References
https://github.com/psd-tools/psd-tools/pull/198
For more information
If you have any questions or comments about this advisory:
- Open an issue in psd-tools
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | psd-tools | >= 1.8.37, < 1.9.4 | 1.9.4 |
References
- https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4
- https://github.com/psd-tools/psd-tools/pull/198
- https://github.com/advisories/GHSA-22jr-vc7j-g762
- https://github.com/psd-tools/psd-tools/security/advisories/GHSA-22jr-vc7j-g762
- https://nvd.nist.gov/vuln/detail/CVE-2020-10571
- https://github.com/psd-tools/psd-tools/commit/fd51f8b4a52bc9c1c06d1035dfdf2cd920e87074
- https://github.com/psd-tools/psd-tools
- https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2020-91.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-754- Platform
- Python (PyPI)
- Package
psd-tools- Disclosed
- 14.03.2020
- Updated
- 11.10.2026 15:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2020-91 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-22jr-vc7j-g762 - CC BY 4.0
Vulnerability history: psd-tools
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 03.2020 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 2
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 3
-
Potential buffer overflow in psd-tools this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.