psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a
    PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected
    row size), decode_rle() raises ValueError which propagated all the way to the user, crashing
    psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels
    with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was
    not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback
    handles the error gracefully. (CVE-2026-27809)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a     PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected     row size), decode_rle() raises ValueError which propagated all the way to the user, crashing     psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels     with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was     not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback     handles the error gracefully. (CVE-2026-27809)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
438098	SCA: security update for psd-tools (GHSA-24p2-j2jr-386w)	Tenable Cloud Security	SCA Checks	Local	high
438098	SCA: security update for psd-tools (GHSA-24p2-j2jr-386w)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
300480	Linux Distros Unpatched Vulnerability : CVE-2026-27809	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-27809

high

Tenable Plugins

high

high

high