psd-tools Security Update Addresses 1 Vulnerability
Tech GuruQuick Answer
psd-tools before 1.17.4 can allocate excessive memory from attacker-controlled PSD dimensions before validating the file. Services using PSDImage.composite() or .numpy() on untrusted input may be terminated by memory exhaustion. Upgrade the Python environment actually used by each worker to 1.17.4.
Confirm Scope And Apply The Supported Fix
What to do now: Locate PSD compositing/conversion workers and their Python environments, update the deployed dependency, and retain worker memory and input-size controls while validating the change.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | psd-tools packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-8q6g-vjhf-jp8m |
| CVE | CVE-2026-59991 |
| Project advisory publication | 2026-06-24 13:30:20 UTC |
| Recorded source timestamp (historical snapshot) | 2026-09-22 19:45:53 UTC |
| Affected versions | psd-tools < 1.17.4 |
| Fixed version | psd-tools 1.17.4 |
| CVSS base score | 7.5 (CVSS v3) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The allocation uses declared image dimensions, channels, depth and layer rectangles, so a small file can request a very large buffer. The vulnerable composite path may return a black image with only a warning; catching exceptions alone does not contain the allocation. Reported memory measurements belong to the project's test, not a test performed here.
What To Validate Now
- Inventory. Locate psd-tools packages and release streams identified in the project advisories deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: psd-tools < 1.17.4 Do not infer applicability from product family or severity alone.
- Remediate. Apply psd-tools 1.17.4 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the running worker imports the fixed package. In a resource-limited test process, check normal composites and controlled oversized-geometry rejection cases, retaining memory and error results. Do not reproduce an out-of-memory payload on a production worker.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The GHSA affected-version field says before 1.17.3, while the CNA says before 1.17.4; both identify 1.17.4 as the patched target. Use that confirmed target and do not infer that 1.17.3 is safe from the inconsistent field. A file-byte limit alone does not bound declared image geometry.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
