{"id":"CVE-2020-10571","aliases":["EUVD-2020-0150","GHSA-22jr-vc7j-g762","PYSEC-2020-91"],"status":"published","title":"Potential buffer overflow in psd-tools","description":"An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01796,"percentile":0.78753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2020-03-14T17:23:28Z","modified":"2026-10-20T10:51:37Z","fixes":[{"ecosystem":"PyPI","package":"psd-tools","fixed_in":["1.9.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"psd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.37"},{"last_affected":"1.9.3"},{"fixed":"1.9.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"psd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.37"},{"fixed":"1.9.4"}]}],"versions":["1.8.37","1.8.38","1.9.0","1.9.1","1.9.2","1.9.3"]},{"source":"osv","ecosystem":"PyPI","package":"psd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4"}]}],"versions":["0.1.1","0.1.2","0.1.3","0.1.4","0.2","0.5","0.6","0.7","0.7.1","0.8","0.8.1","0.8.2","0.8.3","0.8.4","0.9","0.9.1","0.10","1.0","1.1","1.2","1.3","1.4","1.8.8","1.8.9","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.20","1.8.21","1.8.22","1.8.23","1.8.24","1.8.25","1.8.26","1.8.27","1.8.28","1.8.29","1.8.30","1.8.31","1.8.32","1.8.33","1.8.34","1.8.35","1.8.36","1.8.37","1.8.38","1.9.0","1.9.1","1.9.2","1.9.3"]}],"products":[{"vendor":"psd-tools_project","product":"psd-tools"}],"references":[{"url":"https://github.com/psd-tools/psd-tools/pull/198","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/psd-tools/psd-tools/security/advisories/GHSA-22jr-vc7j-g762","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10571","tags":["advisory"]},{"url":"https://github.com/psd-tools/psd-tools/commit/fd51f8b4a52bc9c1c06d1035dfdf2cd920e87074","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2020-91.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-22jr-vc7j-g762","tags":["advisory"]},{"url":"https://github.com/psd-tools/psd-tools","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-10571","description":"An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.","status":"published","published":"2020-03-14T17:23:28Z","modified":"2024-08-04T11:06:09.919Z","updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-0150","description":"An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.","status":"published","published":"2020-03-14T17:23:28Z","modified":"2024-08-04T11:06:09Z","updated_at":"2026-11-03T03:07:50.360823Z"}],"ghsa":[{"id":"GHSA-22jr-vc7j-g762","title":"Potential buffer overflow in psd-tools","description":"### Impact\nAn issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.\n\n### Patches\nUsers of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.\n\n### Workarounds\nWithout Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.\n\n### References\nhttps://github.com/psd-tools/psd-tools/pull/198\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)","status":"published","published":"2020-03-16T22:46:19Z","modified":"2026-09-24T14:55:11Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:41:21.616682Z"}],"nvd":[{"id":"CVE-2020-10571","description":"An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.","status":"published","published":"2020-03-14T18:15:11.453Z","modified":"2026-06-17T02:48:01.443Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:05:55.32877Z"}],"osv":[{"id":"CVE-2020-10571","description":"An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.","status":"published","published":"2020-03-14T18:15:11.453Z","modified":"2026-10-20T10:51:37.110991295Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"GHSA-22jr-vc7j-g762","title":"Potential buffer overflow in psd-tools","description":"### Impact\nAn issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.\n\n### Patches\nUsers of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.\n\n### Workarounds\nWithout Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.\n\n### References\nhttps://github.com/psd-tools/psd-tools/pull/198\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)","status":"published","published":"2020-03-16T22:46:19Z","modified":"2026-09-24T15:00:04.784835352Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"PYSEC-2020-91","description":"An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.","status":"published","published":"2020-03-14T18:15:00Z","modified":"2023-11-08T04:01:58.343121Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}