psd-tools EUVD-2026-84808

Exploitation requires a service or workflow that invokes psd-tools' PSDImage.composite() or PSDImage.numpy() on attacker-supplied PSD files using a vulnerable version (prior to 1.17.4). The crafted PSD needs only an oversized declared header geometry (width, height, channels, depth, or per-layer rectangles); no authentication, user interaction, or special privileges are needed once the file reaches the parser. What LIMITS exploitation: the target must actually accept and composite/rasterize untrusted PSD input (e.g. an upload-and-thumbnail pipeline) - installations that only process trusted local files, or that never call composite()/numpy(), are not exposed. Impact is confined to availability (out-of-memory crash); there is no data disclosure or code execution.

This is a genuine but bounded availability threat, not an over-inflated high-CVSS finding. The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a remote, unauthenticated, low-complexity denial-of-service with NO confidentiality or integrity impact - the C:N/I:N is important because it caps real-world severity at 'service crash/OOM' rather than data compromise or code execution. CWE-789 (memory allocation from an unvalidated size value) matches the description precisely: attacker-controlled PSD header geometry is used to size buffers before the values are validated against actual file data. No EPSS score, KEV listing, or SSVC decision data was provided in the input. A working exploit DOES effectively exist: the fix commit's test suite embeds a 49-byte base64 proof-of-concept PSD declaring a 5964x10296x6 8-bit canvas (~3.35 GB allocation), so publicly available exploit code exists even though this is not confirmed actively exploited. The realistic risk is elevated only for the specific population that composites/parses untrusted, user-supplied PSD files server-side; for offline or trusted-input use it is negligible. Net: a real, easy-to-trigger DoS against exposed PSD-processing services, but availability-only and dependent on the deployment accepting attacker files.

An attacker uploads a tiny (~49-byte) crafted PSD whose header declares enormous width/height/channel dimensions to a web service that thumbnails or composites user-supplied Photoshop files. When the service calls PSDImage.composite() or PSDImage.numpy(), the library allocates a multi-gigabyte output buffer from the unvalidated header before checking it against the actual file, exhausting memory and triggering an OOM kill of the worker or host. A functional 49-byte PoC is already published in the project's own fix-commit test suite, making reproduction trivial.