Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-27809 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Psd-Tools Project Psd-Tools. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27809 affects the psd-tools Python package, used for parsing Adobe Photoshop PSD files, in versions prior to 1.12.2. The vulnerability arises from unhandled malformed RLE-compressed image data in PSD files, such as a literal run extending past the expected row size. This triggers a ValueError in the decode_rle() function, which propagates uncaught through decompress(), psd.composite(), and psd-tools export functions, resulting in application crashes. The issue is rated at CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and is associated with CWEs including CWE-190 (Integer Overflow), CWE-409 (Improper Handling of Highly Compressed Data), and others related to decoding errors.
An unauthenticated attacker over the network with low complexity and no user interaction can exploit this by supplying a specially crafted PSD file to any application or script using vulnerable psd-tools versions. Successful exploitation causes denial of service via crashes in affected functions, with high impact on integrity and availability per the CVSS score, though no confidentiality impact is noted.
The GitHub security advisory (GHSA-24p2-j2jr-386w), release notes for v1.12.2, and commit 6c0a78f195b5942757886a1863793fd5946c1fb1 detail the fix: wrapping the decode_rle() call in a try/except block to trigger the existing decompress() fallback, which replaces failed channels with black pixels instead of propagating the ValueError. Security practitioners should upgrade to psd-tools 1.12.2 or later and validate PSD inputs where possible.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8781
Vulnerability Data
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which…
more
propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V5.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds integer overflow defects before deployment.
Requires the system to fail to a known safe state on specified failures, limiting the impact of unhandled exceptional conditions.
Input validation can reject or limit decompression of data whose expansion ratio exceeds safe thresholds.
Mandates explicit fail-safe procedures triggered by indicated failures, structurally preventing unhandled or mishandled exceptional conditions.
Requiring documented development standards and tools can mandate safe typing, casting rules, and compiler checks that stop the weakness from being introduced.
Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Runtime monitoring of compute resources can detect exhaustion caused by decompression bombs.
Vulnerability identification processes can discover and record reachable-assertion flaws before deployment.
Capacity planning and monitoring directly limits the availability impact of data-amplification attacks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect integer overflows before release.
Documented operating procedures may specify exception handling but do not guarantee implementation.
Redundancy helps availability but does not address the root cause of the weakness.
Logging captures unhandled exceptions, aiding detection but not preventing the weakness.
Monitoring can detect anomalous resource usage but does not prevent the weakness.
Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.