---
id: CVE-2020-10571
aliases:
  - GHSA-22jr-vc7j-g762
  - PYSEC-2020-91
title: Potential buffer overflow in psd-tools
summary: Potential buffer overflow in psd-tools
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: psd-tools
product: psd-tools
ecosystem: pip
affected:
  - 'psd-tools >= 1.8.37, < 1.9.4'
patched:
  - psd-tools 1.9.4
published: '2020-03-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T15:00:04.784835352Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-22jr-vc7j-g762'
references:
  - url: >-
      https://github.com/psd-tools/psd-tools/security/advisories/GHSA-22jr-vc7j-g762
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-10571'
  - url: 'https://github.com/psd-tools/psd-tools/pull/198'
  - url: >-
      https://github.com/psd-tools/psd-tools/commit/fd51f8b4a52bc9c1c06d1035dfdf2cd920e87074
  - url: 'https://github.com/psd-tools/psd-tools'
  - url: 'https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2020-91.yaml
  - url: 'https://github.com/advisories/GHSA-22jr-vc7j-g762'
tags:
  - osv
  - pip
  - ghsa
epss: 0.01796
epssPercentile: 0.77506
cwe:
  - CWE-754
ingestedAt: '2026-09-24T15:45:56.652Z'
---

## Overview

### Impact
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.

### Patches
Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.

### Workarounds
Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.

### References
https://github.com/psd-tools/psd-tools/pull/198

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)

## Affected packages

- `psd-tools >= 1.8.37, < 1.9.4`

## Remediation

Upgrade to a patched release:

- `psd-tools 1.9.4`