Live › vulnerability › CVE-2026-63501
ag-psd is a JavaScript library that reads and writes Photoshop PSD files. A crafted PSD with oversized layer dimensions or compressed data can make the parser allocate more memory than the configured limit, which exhausts process memory and causes denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Applications that parse PSD files supplied by untrusted users, such as upload or image-processing services, with layer decoding enabled. Apps that only read trusted local PSD files, or that never parse user uploads, can skip it.
No product ranges from the sources yet.
npm ls ag-psdreadPsd( calls in code that handles untrusted PSD uploads31.0.3 or later (the description says it is fixed in 31.0.1, and the prior-to bound is 31.0.3)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63501")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.