CVE-2026-27809 is a critical flaw (CVSS 9.1 from NVD) in psd-tools, a Python package for Photoshop PSD files. A PSD with malformed RLE image data raises an uncaught error that crashes compositing and export. Versions before 1.12.2 are affected. Upgrade to 1.12.2. The record does not mark it as exploited in the wild.
What's affected
psd-tools, the PyPI package, all versions before 1.12.2. The fixed version is 1.12.2, per the GitHub advisory.
Any service or script that opens PSD files from outside your control and calls composite or export is the place to look, for example an image conversion worker or a preview generator.
How to check if you're exposed
Find the installed version in each environment and lockfile.
pip show psd-tools
pip freeze | grep -i psd-tools
Search your repositories for requirements and lock files that name psd-tools, and for code that calls its composite or export functions on uploaded files. Container images need the same check inside the image.
What to do now
- Upgrade psd-tools to 1.12.2 or later.
- Run PSD processing in a worker that can fail and restart without taking down the main service, with a time and memory limit.
- Catch and log errors around PSD parsing so one bad file cannot stop a queue.
- Reject uploads above a size you can reasonably process, and handle PSD files from untrusted users in a separate queue.
- Scan your dependencies for other outdated packages at https://gold.safeguard.sh/scan.
Why it matters
The record explains the mechanics plainly. When RLE-compressed image data is malformed, the decode function raises a ValueError. A fallback already existed that replaces failed channels with black pixels, but it never ran because the error was not caught. Version 1.12.2 wraps the call in a try and except so the fallback handles it.
The weakness list on the record is long, including CWE-190 (Integer Overflow or Wraparound), CWE-409 (Improper Handling of Highly Compressed Data), CWE-617 (Reachable Assertion), CWE-704 (Incorrect Type Conversion or Cast), CWE-755 (Improper Handling of Exceptional Conditions) and CWE-789 (Memory Allocation with Excessive Size Value). The behaviour described is a crash on bad input, which is an availability problem. The 9.1 score also assigns high integrity impact, so judge the real risk against how you use the library.
Handling untrusted files in a worker
Parsers of rich file formats, such as PSD, are common sources of crashes. The fix in 1.12.2 makes this one case degrade gracefully, but good isolation also helps against the next bug.
Run conversion in a separate process or job. Set limits on memory, CPU time and file size. Treat a failure as a normal outcome for that one file, log it and move on to the next.
Keep the package current. A parser you depend on will have more advisories over time.
Also review what else touches uploaded files. Thumbnailers, converters and preview generators that open PSD content share the same risk profile, so a limit on file size and a worker boundary protect all of them together.
Try it yourself
Parsers like this stay in a codebase for years. This demo shows how continuous monitoring flags a package when a new advisory lands.
Click through it at your own pace, or open it full screen.
Quick check
Does this let an attacker run code?
The record describes an unhandled exception that crashes compositing and export. It does not describe code execution.
What does the fix change?
It catches the error from the RLE decoder so the existing fallback replaces the failed channel with black pixels.
Sources
Last reviewed: 19 October 2026.
