CVE-2026-27809
psd-tools is a Python package for working with Adobe Photoshop PSD fil ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media).
Descripción
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 12 | psd-tools | sin corrección indicada |
| debian 13 | psd-tools | 1.10.7+dfsg.1-1+deb13u1 |
| debian 14 | psd-tools | 1.14.2+dfsg.1-1 |
| echo | psd-tools | 1.10.7+dfsg.1-1+deb13u1 |
| pip::GitHub Security Advisory pip | psd-tools | 1.12.2 |
| rapidfort debian 12 | psd-tools | 0:1.10.7+dfsg.1-1+deb13u1, 0:1.14.2+dfsg.1-1 |
| rapidfort debian 13 | psd-tools | 0:1.10.7+dfsg.1-1+deb13u1, 0:1.14.2+dfsg.1-1 |
Referencias
- https://github.com/psd-tools/psd-tools
- https://github.com/psd-tools/psd-tools/commit/6c0a78f195b5942757886a1863793fd5946c1fb1
- https://github.com/psd-tools/psd-tools/releases/tag/v1.12.2
- https://github.com/psd-tools/psd-tools/security/advisories/GHSA-24p2-j2jr-386w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27809