CVE-2026-27809: Death by Pixels: Unpacking CVE-2026-27809 in psd-tools

Death by Pixels: Unpacking CVE-2026-27809 in psd-tools Vulnerability ID: CVE-2026-27809 CVSS Score: 6.8 Published: 2026-02-26 A deep dive into a series of memory corruption and logic flaws within the psd-tools Python library. This vulnerability exploits the complex nature of Adobe's PSD format to trigger massive memory exhaustion (Zip Bombs), integer overflows in Cython modules, and bypasses critical integrity checks in production environments. It highlights the dangers of parsing untrusted binary formats without strict bounds checking. TL;DR The psd-tools library prior to 1.12.2 is vulnerable to Denial of Service via malicious PSD files. Attackers can trigger Zip bombs or massive memory allocations by manipulating file headers. Fix involves enforcing strict dimension limits and safe decompression practices. ⚠️ Exploit Status: POC Technical Details Attack Vector : Network (via File Upload) CVSS v4.0 : 6.8 (Medium) Weakness : CWE-400 (Uncontrolled Resource Consumption) Weakness : CWE-19