6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27809

CVE-2026-27809: psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27809

CVE-2026-27809:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
psd-tools	pip	< 1.12.2	1.12.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis focused on the provided commit patch, which addresses several security issues within the psd-tools compression module. The root cause of the vulnerabilities lies in the improper handling of compressed image data and metadata.

The most critical issue was found in the decompress function, which was susceptible to a ZIP bomb attack due to an unguarded call to zlib.decompress. This could lead to memory exhaustion and a denial-of-service. The same function also failed to validate image dimensions (width, height, depth) before memory allocation, potentially causing crashes when processing maliciously crafted files with extremely large dimensions.

Further analysis of the RLE decompression logic in both the Python (rle.py) and Cython (_rle.pyx) implementations revealed that they were not robust against malformed data. Invalid RLE data would cause the decoder to raise an exception, leading to an unhandled crash and another denial-of-service vector. The Cython implementation also contained a latent type-mismatch bug that could theoretically lead to an infinite loop.

The patch addresses these issues by:

Introducing a _safe_zlib_decompress function that enforces a maximum output size to prevent ZIP bombs.
Adding explicit validation for image dimensions in the decompress function.
Replacing a runtime assert with a proper ValueError check.
Making the RLE decoders tolerant to errors by clipping data and padding instead of crashing.
Fixing the type mismatch in the Cython decoder.

By identifying the functions where these changes were made, we can pinpoint the exact locations of the vulnerabilities.

Vulnerable functions

decompress

src/psd_tools/compression/__init__.py

The function directly called `zlib.decompress` without a `max_length` argument, making it vulnerable to a ZIP bomb attack. An attacker could provide a small, compressed file that expands to a very large size, causing memory exhaustion and a denial of service. The function also lacked validation for image dimensions (width, height, depth), which could lead to excessive memory allocation requests and crashes. Additionally, it used an `assert` statement for a data integrity check, which can be disabled in optimized Python environments, removing a security guard.

decode

src/psd_tools/compression/rle.py

The RLE decoding logic was strict and would raise a `ValueError` when encountering malformed or unexpected data, such as a run that would exceed the expected output size. This would cause the application to crash, leading to a denial of service when processing a crafted PSD file.

decode

src/psd_tools/compression/_rle.pyx

The Cython implementation of the RLE decoder used 32-bit `int` for loop indices while the size parameter was a 64-bit `Py_ssize_t`. This type mismatch could lead to undefined behavior or an infinite loop if the input data size exceeded the maximum value of a 32-bit integer. Like its Python counterpart, this function was also vulnerable to crashing on malformed RLE data.

encode

src/psd_tools/compression/_rle.pyx

The function had a minor return type inconsistency for zero-length data. While not a direct security vulnerability, it was identified as a latent defect and code quality issue in the security review, as it relied on implicit type coercion that could be fragile in future Cython versions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.