{"id":"CVE-2020-10571","aliases":["GHSA-22jr-vc7j-g762"],"title":"Potential buffer overflow in psd-tools","summary":"Potential buffer overflow in psd-tools","severity":"critical","cvss":9.8,"cwe":["CWE-754"],"vendor":"psd-tools","product":"psd-tools","ecosystem":"pip","affected":["psd-tools >= 1.8.37, <= 1.9.3"],"patched":["psd-tools 1.9.4"],"published":"2020-03-16","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:55:11Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-22jr-vc7j-g762","references":[{"url":"https://github.com/psd-tools/psd-tools/security/advisories/GHSA-22jr-vc7j-g762"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10571"},{"url":"https://github.com/psd-tools/psd-tools/pull/198"},{"url":"https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4"},{"url":"https://github.com/psd-tools/psd-tools/commit/fd51f8b4a52bc9c1c06d1035dfdf2cd920e87074"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2020-91.yaml"},{"url":"https://github.com/advisories/GHSA-22jr-vc7j-g762"}],"tags":["ghsa","pip"],"epss":0.01796,"epssPercentile":0.77493,"ingestedAt":"2026-09-24T15:45:56.652Z","slug":"CVE-2020-10571","body":"## Overview\n\n### Impact\nAn issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.\n\n### Patches\nUsers of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.\n\n### Workarounds\nWithout Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.\n\n### References\nhttps://github.com/psd-tools/psd-tools/pull/198\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)\n\n## Affected packages\n\n- `psd-tools >= 1.8.37, <= 1.9.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `psd-tools 1.9.4`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}