ag-psd PSD layer decoding allocates unbounded memory, causing denial of service
Servers that open Photoshop files can be frozen by one bad file.
Summary
ag-psd is a JavaScript library for reading and writing Photoshop files. An attacker can send one crafted PSD file to an application that parses untrusted PSDs, exhausting memory and stopping the service.
Affected when
- Application parsing untrusted PSD files with ag-psd
- Layer decoding enabled
What to do
Update to ag-psd 31.0.1 or later (31.0.0 and older are affected).
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen