{"schema":"threatline.record/2","record":{"id":"CVE-2020-10571","aliases":["GHSA-22jr-vc7j-g762","PYSEC-2020-91"],"summary":"Potential buffer overflow in psd-tools","details":"### Impact\nAn issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.\n\n### Patches\nUsers of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.\n\n### Workarounds\nWithout Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.\n\n### References\nhttps://github.com/psd-tools/psd-tools/pull/198\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)","categories":["Libraries & packages"],"product":"psd-tools","vendor":"n/a","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-22jr-vc7j-g762","source_modified_at":"2026-09-24T14:55:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"psd-tools"},"range":">= 1.8.37, <= 1.9.3"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-10571","source_modified_at":"2024-08-04T11:06:09.919Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-22jr-vc7j-g762","source_modified_at":"2026-09-24T15:00:04.784835352Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"psd-tools","ecosystem":"PyPI","purl":"pkg:pypi/psd-tools"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.37"},{"fixed":"1.9.4"}]}],"versions":["1.8.37","1.8.38","1.9.0","1.9.1","1.9.2","1.9.3"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-22jr-vc7j-g762","source_modified_at":"2026-09-24T14:55:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"psd-tools"},"version":"1.9.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-22jr-vc7j-g762","source_modified_at":"2026-09-24T15:00:04.784835352Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"psd-tools","ecosystem":"PyPI","purl":"pkg:pypi/psd-tools"},"version":"1.9.4"}],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01796,"percentile":0.78285,"score_date":"2026-10-23"},"published_at":"2020-03-14T17:23:28.000Z","modified_at":"2026-09-24T15:00:04.784835352Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-22jr-vc7j-g762","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T14:55:11Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2020-10571","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2024-08-04T11:06:09.919Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-22jr-vc7j-g762","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-24T15:00:04.784835352Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10571","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://github.com/psd-tools/psd-tools/security/advisories/GHSA-22jr-vc7j-g762","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10571","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/psd-tools/psd-tools/pull/198","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://github.com/psd-tools/psd-tools/releases/tag/v1.9.4","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://github.com/psd-tools/psd-tools/commit/fd51f8b4a52bc9c1c06d1035dfdf2cd920e87074","source":"GitHub Advisory Database"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/psd-tools/PYSEC-2020-91.yaml","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-22jr-vc7j-g762","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-24T15:00:04.784835352Z","content_hash":"63e426ebf346938877a3556ef8e410945dd15713df817640db16f1f0bb71ab9d"}}