{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-27809", "tracking": { "current_release_date": "2026-03-20T09:39:47.868458Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-27809", "initial_release_date": "2026-02-26T00:25:35.722919Z", "revision_history": [ { "date": "2026-02-26T00:25:35.722919Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-02-26T00:25:37.654236Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-02-26T00:38:32.401642Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)." }, { "date": "2026-02-26T00:38:36.009653Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-02-26T11:46:55.667944Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (52).| Products created (49).| References created (5).| CWES updated (1)." }, { "date": "2026-02-26T11:47:11.282984Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-02-26T14:13:33.565414Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-02-26T14:13:35.538674Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-02-26T15:39:47.512685Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-02-26T15:39:54.194880Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-02-26T15:45:23.125257Z", "number": "11", "summary": "Unknown change." }, { "date": "2026-02-26T18:35:58.455002Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (38).| Product Identifiers created (105).| Products created (68).| References created (4).| CWES updated (1)." }, { "date": "2026-02-27T00:45:54.359200Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products created (1)." }, { "date": "2026-03-02T16:16:24.503774Z", "number": "14", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products created (1)." }, { "date": "2026-03-02T16:16:28.632538Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-03-02T19:25:11.447215Z", "number": "16", "summary": "CVSS created.| Products created (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-03-02T19:25:14.955178Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:39:44.177575Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:39:46.978362Z", "number": "19", "summary": "NCSC Score updated." } ], "status": "interim", "version": "19" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.12.2", "product": { "name": "vers:unknown/<1.12.2", "product_id": "CSAFPID-5754431", "product_identification_helper": { "cpe": "cpe:2.3:a:psd-tools_project:psd-tools:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Psd-tools" } ], "category": "vendor", "name": "Psd-tools Project" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-5733944" } } ], "category": "product_name", "name": "psd-tools" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.1", "product": { "name": "vers:unknown/0.1", "product_id": "CSAFPID-4563051" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1", "product": { "name": "vers:unknown/0.1.1", "product_id": "CSAFPID-4563052", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.2", "product": { "name": "vers:unknown/0.1.2", "product_id": "CSAFPID-4563053", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.3", "product": { "name": "vers:unknown/0.1.3", "product_id": "CSAFPID-4563054", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.4", "product": { "name": "vers:unknown/0.1.4", "product_id": "CSAFPID-4563055", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.10", "product": { "name": "vers:unknown/0.10", "product_id": "CSAFPID-4563056", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2", "product": { "name": "vers:unknown/0.2", "product_id": "CSAFPID-4563057", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5", "product": { "name": "vers:unknown/0.5", "product_id": "CSAFPID-4563058", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6", "product": { "name": "vers:unknown/0.6", "product_id": "CSAFPID-4563059", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7", "product": { "name": "vers:unknown/0.7", "product_id": "CSAFPID-4563060", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.1", "product": { "name": "vers:unknown/0.7.1", "product_id": "CSAFPID-4563061", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8", "product": { "name": "vers:unknown/0.8", "product_id": "CSAFPID-4563062", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.1", "product": { "name": "vers:unknown/0.8.1", "product_id": "CSAFPID-4563063", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.2", "product": { "name": "vers:unknown/0.8.2", "product_id": "CSAFPID-4563064", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.8.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.3", "product": { "name": "vers:unknown/0.8.3", "product_id": "CSAFPID-4563065", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.8.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.4", "product": { "name": "vers:unknown/0.8.4", "product_id": "CSAFPID-4563066", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.8.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9", "product": { "name": "vers:unknown/0.9", "product_id": "CSAFPID-4563067", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9.1", "product": { "name": "vers:unknown/0.9.1", "product_id": "CSAFPID-4563068", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@0.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0", "product": { "name": "vers:unknown/1.0", "product_id": "CSAFPID-4563069", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1", "product": { "name": "vers:unknown/1.1", "product_id": "CSAFPID-4563070", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.0", "product": { "name": "vers:unknown/1.10.0", "product_id": "CSAFPID-5731716", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.1", "product": { "name": "vers:unknown/1.10.1", "product_id": "CSAFPID-5731717", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.10", "product": { "name": "vers:unknown/1.10.10", "product_id": "CSAFPID-5731718", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.11", "product": { "name": "vers:unknown/1.10.11", "product_id": "CSAFPID-5731719", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.11" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.12", "product": { "name": "vers:unknown/1.10.12", "product_id": "CSAFPID-5731720", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.12" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.13", "product": { "name": "vers:unknown/1.10.13", "product_id": "CSAFPID-5731721", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.13" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.2", "product": { "name": "vers:unknown/1.10.2", "product_id": "CSAFPID-5731722", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.3", "product": { "name": "vers:unknown/1.10.3", "product_id": "CSAFPID-5731723", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.4", "product": { "name": "vers:unknown/1.10.4", "product_id": "CSAFPID-5731724", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.5", "product": { "name": "vers:unknown/1.10.5", "product_id": "CSAFPID-5731725", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.6", "product": { "name": "vers:unknown/1.10.6", "product_id": "CSAFPID-5731726", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.7", "product": { "name": "vers:unknown/1.10.7", "product_id": "CSAFPID-5731727", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.8", "product": { "name": "vers:unknown/1.10.8", "product_id": "CSAFPID-5731728", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.10.9", "product": { "name": "vers:unknown/1.10.9", "product_id": "CSAFPID-5731729", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.10.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.11.0", "product": { "name": "vers:unknown/1.11.0", "product_id": "CSAFPID-5731730", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.11.1", "product": { "name": "vers:unknown/1.11.1", "product_id": "CSAFPID-5731731", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.11.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.12.0", "product": { "name": "vers:unknown/1.12.0", "product_id": "CSAFPID-5731732", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.12.1", "product": { "name": "vers:unknown/1.12.1", "product_id": "CSAFPID-5731733", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2", "product": { "name": "vers:unknown/1.2", "product_id": "CSAFPID-4563071", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3", "product": { "name": "vers:unknown/1.3", "product_id": "CSAFPID-4563072", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.4", "product": { "name": "vers:unknown/1.4", "product_id": "CSAFPID-4563073", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.10", "product": { "name": "vers:unknown/1.8.10", "product_id": "CSAFPID-4563074", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.11", "product": { "name": "vers:unknown/1.8.11", "product_id": "CSAFPID-4563075", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.11" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.12", "product": { "name": "vers:unknown/1.8.12", "product_id": "CSAFPID-4563076", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.12" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.13", "product": { "name": "vers:unknown/1.8.13", "product_id": "CSAFPID-5731734", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.13" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.14", "product": { "name": "vers:unknown/1.8.14", "product_id": "CSAFPID-4563077", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.14" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.15", "product": { "name": "vers:unknown/1.8.15", "product_id": "CSAFPID-5731735", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.15" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.16", "product": { "name": "vers:unknown/1.8.16", "product_id": "CSAFPID-5731736", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.16" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.17", "product": { "name": "vers:unknown/1.8.17", "product_id": "CSAFPID-4563078", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.17" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.18", "product": { "name": "vers:unknown/1.8.18", "product_id": "CSAFPID-5731737", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.18" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.19", "product": { "name": "vers:unknown/1.8.19", "product_id": "CSAFPID-5731738", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.19" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.20", "product": { "name": "vers:unknown/1.8.20", "product_id": "CSAFPID-5731739", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.20" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.21", "product": { "name": "vers:unknown/1.8.21", "product_id": "CSAFPID-4563079", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.21" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.22", "product": { "name": "vers:unknown/1.8.22", "product_id": "CSAFPID-5731740", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.22" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.23", "product": { "name": "vers:unknown/1.8.23", "product_id": "CSAFPID-5731741", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.23" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.24", "product": { "name": "vers:unknown/1.8.24", "product_id": "CSAFPID-5731742", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.24" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.25", "product": { "name": "vers:unknown/1.8.25", "product_id": "CSAFPID-4563080", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.25" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.26", "product": { "name": "vers:unknown/1.8.26", "product_id": "CSAFPID-4563081", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.26" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.27", "product": { "name": "vers:unknown/1.8.27", "product_id": "CSAFPID-5731743", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.27" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.28", "product": { "name": "vers:unknown/1.8.28", "product_id": "CSAFPID-5731744", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.28" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.29", "product": { "name": "vers:unknown/1.8.29", "product_id": "CSAFPID-5731745", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.29" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.30", "product": { "name": "vers:unknown/1.8.30", "product_id": "CSAFPID-5731746", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.30" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.31", "product": { "name": "vers:unknown/1.8.31", "product_id": "CSAFPID-5731747", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.31" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.32", "product": { "name": "vers:unknown/1.8.32", "product_id": "CSAFPID-5731748", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.32" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.33", "product": { "name": "vers:unknown/1.8.33", "product_id": "CSAFPID-5731749", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.33" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.34", "product": { "name": "vers:unknown/1.8.34", "product_id": "CSAFPID-5731750", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.34" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.35", "product": { "name": "vers:unknown/1.8.35", "product_id": "CSAFPID-5731751", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.35" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.36", "product": { "name": "vers:unknown/1.8.36", "product_id": "CSAFPID-5731752", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.36" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.37", "product": { "name": "vers:unknown/1.8.37", "product_id": "CSAFPID-4820512", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.37" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.38", "product": { "name": "vers:unknown/1.8.38", "product_id": "CSAFPID-4820513", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.38" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.8", "product": { "name": "vers:unknown/1.8.8", "product_id": "CSAFPID-4563082", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.9", "product": { "name": "vers:unknown/1.8.9", "product_id": "CSAFPID-4563083", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.8.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.0", "product": { "name": "vers:unknown/1.9.0", "product_id": "CSAFPID-4820514", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.1", "product": { "name": "vers:unknown/1.9.1", "product_id": "CSAFPID-4820515", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.10", "product": { "name": "vers:unknown/1.9.10", "product_id": "CSAFPID-5731753", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.11", "product": { "name": "vers:unknown/1.9.11", "product_id": "CSAFPID-5731754", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.11" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.12", "product": { "name": "vers:unknown/1.9.12", "product_id": "CSAFPID-5731755", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.12" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.13", "product": { "name": "vers:unknown/1.9.13", "product_id": "CSAFPID-5731756", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.13" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.14", "product": { "name": "vers:unknown/1.9.14", "product_id": "CSAFPID-5731757", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.14" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.15", "product": { "name": "vers:unknown/1.9.15", "product_id": "CSAFPID-5731758", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.15" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.16", "product": { "name": "vers:unknown/1.9.16", "product_id": "CSAFPID-5731759", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.16" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.17", "product": { "name": "vers:unknown/1.9.17", "product_id": "CSAFPID-5731760", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.17" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.18", "product": { "name": "vers:unknown/1.9.18", "product_id": "CSAFPID-5731761", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.18" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.19", "product": { "name": "vers:unknown/1.9.19", "product_id": "CSAFPID-5731762", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.19" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.2", "product": { "name": "vers:unknown/1.9.2", "product_id": "CSAFPID-4820516", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.20", "product": { "name": "vers:unknown/1.9.20", "product_id": "CSAFPID-5731763", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.20" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.21", "product": { "name": "vers:unknown/1.9.21", "product_id": "CSAFPID-5731764", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.21" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.22", "product": { "name": "vers:unknown/1.9.22", "product_id": "CSAFPID-5731765", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.22" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.23", "product": { "name": "vers:unknown/1.9.23", "product_id": "CSAFPID-5731766", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.23" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.24", "product": { "name": "vers:unknown/1.9.24", "product_id": "CSAFPID-5731767", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.24" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.26", "product": { "name": "vers:unknown/1.9.26", "product_id": "CSAFPID-5731768", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.26" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.27", "product": { "name": "vers:unknown/1.9.27", "product_id": "CSAFPID-5731769", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.27" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.28", "product": { "name": "vers:unknown/1.9.28", "product_id": "CSAFPID-5731770", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.28" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.29", "product": { "name": "vers:unknown/1.9.29", "product_id": "CSAFPID-5731771", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.29" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.3", "product": { "name": "vers:unknown/1.9.3", "product_id": "CSAFPID-4820517", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.30", "product": { "name": "vers:unknown/1.9.30", "product_id": "CSAFPID-5731772", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.30" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.31", "product": { "name": "vers:unknown/1.9.31", "product_id": "CSAFPID-5731773", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.31" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.32", "product": { "name": "vers:unknown/1.9.32", "product_id": "CSAFPID-5731774", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.32" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.33", "product": { "name": "vers:unknown/1.9.33", "product_id": "CSAFPID-5731775", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.33" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.34", "product": { "name": "vers:unknown/1.9.34", "product_id": "CSAFPID-5731776", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.34" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.4", "product": { "name": "vers:unknown/1.9.4", "product_id": "CSAFPID-5731777", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.5", "product": { "name": "vers:unknown/1.9.5", "product_id": "CSAFPID-5731778", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.6", "product": { "name": "vers:unknown/1.9.6", "product_id": "CSAFPID-5731779", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.7", "product": { "name": "vers:unknown/1.9.7", "product_id": "CSAFPID-5731780", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.8", "product": { "name": "vers:unknown/1.9.8", "product_id": "CSAFPID-5731781", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.9.9", "product": { "name": "vers:unknown/1.9.9", "product_id": "CSAFPID-5731782", "product_identification_helper": { "purl": "pkg:pypi/psd-tools@1.9.9" } } }, { "category": "product_version_range", "name": "vers:unknown/<1.12.2", "product": { "name": "vers:unknown/<1.12.2", "product_id": "CSAFPID-5723111" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<1.12.2", "product": { "name": "vers:unknown/>=0|<1.12.2", "product_id": "CSAFPID-5731783" } }, { "category": "product_version_range", "name": "vers:unknown/v.1.9.0", "product": { "name": "vers:unknown/v.1.9.0", "product_id": "CSAFPID-4563084" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.0", "product": { "name": "vers:unknown/v1.10.0", "product_id": "CSAFPID-5729639" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.1", "product": { "name": "vers:unknown/v1.10.1", "product_id": "CSAFPID-5729640" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.10", "product": { "name": "vers:unknown/v1.10.10", "product_id": "CSAFPID-5729641" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.11", "product": { "name": "vers:unknown/v1.10.11", "product_id": "CSAFPID-5729642" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.12", "product": { "name": "vers:unknown/v1.10.12", "product_id": "CSAFPID-5729643" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.13", "product": { "name": "vers:unknown/v1.10.13", "product_id": "CSAFPID-5729644" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.2", "product": { "name": "vers:unknown/v1.10.2", "product_id": "CSAFPID-5729645" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.3", "product": { "name": "vers:unknown/v1.10.3", "product_id": "CSAFPID-5729646" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.4", "product": { "name": "vers:unknown/v1.10.4", "product_id": "CSAFPID-5729647" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.5", "product": { "name": "vers:unknown/v1.10.5", "product_id": "CSAFPID-5729648" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.6", "product": { "name": "vers:unknown/v1.10.6", "product_id": "CSAFPID-5729649" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.7", "product": { "name": "vers:unknown/v1.10.7", "product_id": "CSAFPID-5729650" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.8", "product": { "name": "vers:unknown/v1.10.8", "product_id": "CSAFPID-5729651" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.9", "product": { "name": "vers:unknown/v1.10.9", "product_id": "CSAFPID-5729652" } }, { "category": "product_version_range", "name": "vers:unknown/v1.11.0", "product": { "name": "vers:unknown/v1.11.0", "product_id": "CSAFPID-5729653" } }, { "category": "product_version_range", "name": "vers:unknown/v1.11.1", "product": { "name": "vers:unknown/v1.11.1", "product_id": "CSAFPID-5729654" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.0", "product": { "name": "vers:unknown/v1.12.0", "product_id": "CSAFPID-5729655" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.1", "product": { "name": "vers:unknown/v1.12.1", "product_id": "CSAFPID-5729656" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.26", "product": { "name": "vers:unknown/v1.8.26", "product_id": "CSAFPID-4563085" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.27", "product": { "name": "vers:unknown/v1.8.27", "product_id": "CSAFPID-4563086" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.28", "product": { "name": "vers:unknown/v1.8.28", "product_id": "CSAFPID-4563087" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.29", "product": { "name": "vers:unknown/v1.8.29", "product_id": "CSAFPID-4563088" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.30", "product": { "name": "vers:unknown/v1.8.30", "product_id": "CSAFPID-4563089" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.31", "product": { "name": "vers:unknown/v1.8.31", "product_id": "CSAFPID-4563090" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.32", "product": { "name": "vers:unknown/v1.8.32", "product_id": "CSAFPID-4563091" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.33", "product": { "name": "vers:unknown/v1.8.33", "product_id": "CSAFPID-4563092" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.34", "product": { "name": "vers:unknown/v1.8.34", "product_id": "CSAFPID-4563093" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.35", "product": { "name": "vers:unknown/v1.8.35", "product_id": "CSAFPID-4563094" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.36", "product": { "name": "vers:unknown/v1.8.36", "product_id": "CSAFPID-4563095" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.37.post1", "product": { "name": "vers:unknown/v1.8.37.post1", "product_id": "CSAFPID-4563096" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.37.post2", "product": { "name": "vers:unknown/v1.8.37.post2", "product_id": "CSAFPID-4563097" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.37.post3", "product": { "name": "vers:unknown/v1.8.37.post3", "product_id": "CSAFPID-4563098" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.38", "product": { "name": "vers:unknown/v1.8.38", "product_id": "CSAFPID-4563099" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.1", "product": { "name": "vers:unknown/v1.9.1", "product_id": "CSAFPID-4563100" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.10", "product": { "name": "vers:unknown/v1.9.10", "product_id": "CSAFPID-5729657" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.11", "product": { "name": "vers:unknown/v1.9.11", "product_id": "CSAFPID-5729658" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.12", "product": { "name": "vers:unknown/v1.9.12", "product_id": "CSAFPID-5729659" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.13", "product": { "name": "vers:unknown/v1.9.13", "product_id": "CSAFPID-5729660" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.14", "product": { "name": "vers:unknown/v1.9.14", "product_id": "CSAFPID-5729661" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.15", "product": { "name": "vers:unknown/v1.9.15", "product_id": "CSAFPID-5729662" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.16", "product": { "name": "vers:unknown/v1.9.16", "product_id": "CSAFPID-5729663" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.17", "product": { "name": "vers:unknown/v1.9.17", "product_id": "CSAFPID-5729664" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.18", "product": { "name": "vers:unknown/v1.9.18", "product_id": "CSAFPID-5729665" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.19", "product": { "name": "vers:unknown/v1.9.19", "product_id": "CSAFPID-5729666" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.2", "product": { "name": "vers:unknown/v1.9.2", "product_id": "CSAFPID-4563101" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.20", "product": { "name": "vers:unknown/v1.9.20", "product_id": "CSAFPID-5729667" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.21", "product": { "name": "vers:unknown/v1.9.21", "product_id": "CSAFPID-5729668" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.22", "product": { "name": "vers:unknown/v1.9.22", "product_id": "CSAFPID-5729669" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.23", "product": { "name": "vers:unknown/v1.9.23", "product_id": "CSAFPID-5729670" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.24", "product": { "name": "vers:unknown/v1.9.24", "product_id": "CSAFPID-5729671" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.25", "product": { "name": "vers:unknown/v1.9.25", "product_id": "CSAFPID-5729672" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.26", "product": { "name": "vers:unknown/v1.9.26", "product_id": "CSAFPID-5729673" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.27", "product": { "name": "vers:unknown/v1.9.27", "product_id": "CSAFPID-5729674" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.28", "product": { "name": "vers:unknown/v1.9.28", "product_id": "CSAFPID-5729675" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.29", "product": { "name": "vers:unknown/v1.9.29", "product_id": "CSAFPID-5729676" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.3", "product": { "name": "vers:unknown/v1.9.3", "product_id": "CSAFPID-4563102" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.30", "product": { "name": "vers:unknown/v1.9.30", "product_id": "CSAFPID-5729677" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.31", "product": { "name": "vers:unknown/v1.9.31", "product_id": "CSAFPID-5729678" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.32", "product": { "name": "vers:unknown/v1.9.32", "product_id": "CSAFPID-5729679" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.33", "product": { "name": "vers:unknown/v1.9.33", "product_id": "CSAFPID-5729680" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.34", "product": { "name": "vers:unknown/v1.9.34", "product_id": "CSAFPID-5729681" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.4", "product": { "name": "vers:unknown/v1.9.4", "product_id": "CSAFPID-5729682" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.5", "product": { "name": "vers:unknown/v1.9.5", "product_id": "CSAFPID-5729683" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.6", "product": { "name": "vers:unknown/v1.9.6", "product_id": "CSAFPID-5729684" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.7", "product": { "name": "vers:unknown/v1.9.7", "product_id": "CSAFPID-5729685" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.8", "product": { "name": "vers:unknown/v1.9.8", "product_id": "CSAFPID-5729686" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.9", "product": { "name": "vers:unknown/v1.9.9", "product_id": "CSAFPID-5729687" } } ], "category": "product_name", "name": "psd-tools" } ], "category": "vendor", "name": "psd-tools" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.12.2", "product": { "name": "vers:unknown/<1.12.2", "product_id": "CSAFPID-5753657" } } ], "category": "product_name", "name": "psd-tools" } ], "category": "vendor", "name": "unknown" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-27809", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-27809" }, { "category": "description", "text": "psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-27809" }, { "category": "description", "text": "psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-27809.json?alt=media" }, { "category": "description", "text": "## Summary\n\nA security review of the `psd_tools.compression` module (conducted against the `fix/invalid-rle-compression` branch, commits `7490ffa`–`2a006f5`) identified the following pre-existing issues. The two findings introduced and **fixed** by those commits (Cython buffer overflow, `IndexError` on lone repeat header) are excluded from this report.\n\n---\n\n## Findings\n\n### 1. Unguarded `zlib.decompress` — ZIP bomb / memory exhaustion (Medium)\n\n**Location**: `src/psd_tools/compression/__init__.py`, lines 159 and 162\n\n```python\nresult = zlib.decompress(data) # Compression.ZIP\ndecompressed = zlib.decompress(data) # Compression.ZIP_WITH_PREDICTION\n```\n\n`zlib.decompress` is called without a `max_length` cap. A crafted PSD file containing a ZIP-compressed channel whose compressed payload expands to gigabytes would exhaust process memory before any limit is enforced. The RLE path is not vulnerable to this because the decoder pre-allocates exactly `row_size × height` bytes; the ZIP path has no equivalent ceiling.\n\n**Impact**: Denial-of-service / OOM crash when processing untrusted PSD files.\n\n**Suggested mitigation**: Pass a reasonable `max_length` to `zlib.decompress`, derived from the expected `width * height * depth // 8` byte count already computed in `decompress()`.\n\n---\n\n### 2. No upper-bound validation on image dimensions before allocation (Low)\n\n**Location**: `src/psd_tools/compression/__init__.py`, lines 138 and 193\n\n```python\nlength = width * height * max(1, depth // 8) # decompress()\nrow_size = max(width * depth // 8, 1) # decode_rle()\n```\n\nNeither `width`, `height`, nor `depth` are range-checked before these values drive memory allocation. The PSD format (version 2 / PSB) permits dimensions up to 300,000 × 300,000 pixels; a 4-channel 32-bit image at that size would require ~144 TB to hold. While the OS/Python allocator will reject such a request, there is no early, explicit guard that produces a clean, user-facing error.\n\n**Impact**: Uncontrolled allocation attempt from a malformed or adversarially crafted PSB file; hard crash rather than a recoverable error.\n\n**Suggested mitigation**: Validate `width`, `height`, and `depth` against known PSD/PSB limits before entering decompression, and raise a descriptive `ValueError` early.\n\n---\n\n### 3. `assert` used as a runtime integrity check (Low)\n\n**Location**: `src/psd_tools/compression/__init__.py`, line 170\n\n```python\nassert len(result) == length, \"len=%d, expected=%d\" % (len(result), length)\n```\n\nThis assertion can be silently disabled by running the interpreter with `-O` (or `-OO`), which strips all `assert` statements. If the assertion ever becomes relevant (e.g., after future refactoring), disabling it would allow a length mismatch to propagate silently into downstream image compositing.\n\n**Impact**: Loss of an integrity guard in optimised deployments.\n\n**Suggested mitigation**: Replace with an explicit `if` + `raise ValueError(...)`.\n\n---\n\n### 4. `cdef int` indices vs. `Py_ssize_t size` type mismatch in Cython decoder (Low)\n\n**Location**: `src/psd_tools/compression/_rle.pyx`, lines 18–20\n\n```cython\ncdef int i = 0\ncdef int j = 0\ncdef int length = data.shape[0]\n```\n\nAll loop indices are C `signed int` (32-bit). The `size` parameter is `Py_ssize_t` (64-bit on modern platforms). The comparison `j < size` promotes `j` to `Py_ssize_t`, but if `j` wraps due to a row size exceeding `INT_MAX` (~2.1 GB), the resulting comparison is undefined behaviour in C. In practice, row sizes are bounded by PSD/PSB dimension limits and are unreachable at this scale; however, the mismatch is a latent defect if the function is ever called directly with large synthetic inputs.\n\n**Impact**: Theoretical infinite loop or UB at >2 GB row sizes; not reachable from standard PSD/PSB parsing.\n\n**Suggested mitigation**: Change `cdef int i`, `j`, `length` to `cdef Py_ssize_t`.\n\n---\n\n### 5. Silent data degradation not surfaced to callers (Informational)\n\n**Location**: `src/psd_tools/compression/__init__.py`, lines 144–157\n\nThe tolerant RLE decoder (introduced in `2a006f5`) replaces malformed channel data with zero-padded (black) pixels and emits a `logger.warning`. This is the correct trade-off over crashing, but the warning is only observable if the caller has configured a log handler. The public `PSDImage` API does not surface channel-level decode failures to the user in any other way.\n\n**Impact**: A user parsing a silently corrupt file gets a visually wrong image with no programmatic signal to check.\n\n**Suggested mitigation**: Consider exposing a per-channel decode-error flag or raising a distinct warning category that users can filter or escalate via the `warnings` module.\n\n---\n\n### 6. `encode()` zero-length return type inconsistency in Cython (Informational)\n\n**Location**: `src/psd_tools/compression/_rle.pyx`, lines 66–67\n\n```cython\nif length == 0:\n return data # returns a memoryview, not an explicit std::string\n```\n\nAll other return paths return an explicit `cdef string result`. This path returns `data` (a `const unsigned char[:]` memoryview) and relies on Cython's implicit coercion to `bytes`. It is functionally equivalent today but is semantically inconsistent and fragile if Cython's coercion rules change in a future version.\n\n**Impact**: Potential silent breakage in future Cython versions; not a current security issue.\n\n**Suggested mitigation**: Replace `return data` with `return result` (the already-declared empty `string`).\n\n---\n\n## Environment\n\n- Branch: `fix/invalid-rle-compression`\n- Reviewed commits: `7490ffa`, `2a006f5`\n- Python: 3.x (Cython extension compiled for CPython)", "title": "github - https://github.com/advisories/GHSA-24p2-j2jr-386w" }, { "category": "description", "text": "## Summary\n\nA security review of the `psd_tools.compression` module (conducted against the `fix/invalid-rle-compression` branch, commits `7490ffa`–`2a006f5`) identified the following pre-existing issues. The two findings introduced and **fixed** by those commits (Cython buffer overflow, `IndexError` on lone repeat header) are excluded from this report.\n\n---\n\n## Findings\n\n### 1. Unguarded `zlib.decompress` — ZIP bomb / memory exhaustion (Medium)\n\n**Location**: `src/psd_tools/compression/__init__.py`, lines 159 and 162\n\n```python\nresult = zlib.decompress(data) # Compression.ZIP\ndecompressed = zlib.decompress(data) # Compression.ZIP_WITH_PREDICTION\n```\n\n`zlib.decompress` is called without a `max_length` cap. A crafted PSD file containing a ZIP-compressed channel whose compressed payload expands to gigabytes would exhaust process memory before any limit is enforced. The RLE path is not vulnerable to this because the decoder pre-allocates exactly `row_size × height` bytes; the ZIP path has no equivalent ceiling.\n\n**Impact**: Denial-of-service / OOM crash when processing untrusted PSD files.\n\n**Suggested mitigation**: Pass a reasonable `max_length` to `zlib.decompress`, derived from the expected `width * height * depth // 8` byte count already computed in `decompress()`.\n\n---\n\n### 2. No upper-bound validation on image dimensions before allocation (Low)\n\n**Location**: `src/psd_tools/compression/__init__.py`, lines 138 and 193\n\n```python\nlength = width * height * max(1, depth // 8) # decompress()\nrow_size = max(width * depth // 8, 1) # decode_rle()\n```\n\nNeither `width`, `height`, nor `depth` are range-checked before these values drive memory allocation. The PSD format (version 2 / PSB) permits dimensions up to 300,000 × 300,000 pixels; a 4-channel 32-bit image at that size would require ~144 TB to hold. While the OS/Python allocator will reject such a request, there is no early, explicit guard that produces a clean, user-facing error.\n\n**Impact**: Uncontrolled allocation attempt from a malformed or adversarially crafted PSB file; hard crash rather than a recoverable error.\n\n**Suggested mitigation**: Validate `width`, `height`, and `depth` against known PSD/PSB limits before entering decompression, and raise a descriptive `ValueError` early.\n\n---\n\n### 3. `assert` used as a runtime integrity check (Low)\n\n**Location**: `src/psd_tools/compression/__init__.py`, line 170\n\n```python\nassert len(result) == length, \"len=%d, expected=%d\" % (len(result), length)\n```\n\nThis assertion can be silently disabled by running the interpreter with `-O` (or `-OO`), which strips all `assert` statements. If the assertion ever becomes relevant (e.g., after future refactoring), disabling it would allow a length mismatch to propagate silently into downstream image compositing.\n\n**Impact**: Loss of an integrity guard in optimised deployments.\n\n**Suggested mitigation**: Replace with an explicit `if` + `raise ValueError(...)`.\n\n---\n\n### 4. `cdef int` indices vs. `Py_ssize_t size` type mismatch in Cython decoder (Low)\n\n**Location**: `src/psd_tools/compression/_rle.pyx`, lines 18–20\n\n```cython\ncdef int i = 0\ncdef int j = 0\ncdef int length = data.shape[0]\n```\n\nAll loop indices are C `signed int` (32-bit). The `size` parameter is `Py_ssize_t` (64-bit on modern platforms). The comparison `j < size` promotes `j` to `Py_ssize_t`, but if `j` wraps due to a row size exceeding `INT_MAX` (~2.1 GB), the resulting comparison is undefined behaviour in C. In practice, row sizes are bounded by PSD/PSB dimension limits and are unreachable at this scale; however, the mismatch is a latent defect if the function is ever called directly with large synthetic inputs.\n\n**Impact**: Theoretical infinite loop or UB at >2 GB row sizes; not reachable from standard PSD/PSB parsing.\n\n**Suggested mitigation**: Change `cdef int i`, `j`, `length` to `cdef Py_ssize_t`.\n\n---\n\n### 5. Silent data degradation not surfaced to callers (Informational)\n\n**Location**: `src/psd_tools/compression/__init__.py`, lines 144–157\n\nThe tolerant RLE decoder (introduced in `2a006f5`) replaces malformed channel data with zero-padded (black) pixels and emits a `logger.warning`. This is the correct trade-off over crashing, but the warning is only observable if the caller has configured a log handler. The public `PSDImage` API does not surface channel-level decode failures to the user in any other way.\n\n**Impact**: A user parsing a silently corrupt file gets a visually wrong image with no programmatic signal to check.\n\n**Suggested mitigation**: Consider exposing a per-channel decode-error flag or raising a distinct warning category that users can filter or escalate via the `warnings` module.\n\n---\n\n### 6. `encode()` zero-length return type inconsistency in Cython (Informational)\n\n**Location**: `src/psd_tools/compression/_rle.pyx`, lines 66–67\n\n```cython\nif length == 0:\n return data # returns a memoryview, not an explicit std::string\n```\n\nAll other return paths return an explicit `cdef string result`. This path returns `data` (a `const unsigned char[:]` memoryview) and relies on Cython's implicit coercion to `bytes`. It is functionally equivalent today but is semantically inconsistent and fragile if Cython's coercion rules change in a future version.\n\n**Impact**: Potential silent breakage in future Cython versions; not a current security issue.\n\n**Suggested mitigation**: Replace `return data` with `return result` (the already-declared empty `string`).\n\n---\n\n## Environment\n\n- Branch: `fix/invalid-rle-compression`\n- Reviewed commits: `7490ffa`, `2a006f5`\n- Python: 3.x (Cython extension compiled for CPython)", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-24p2-j2jr-386w.json?alt=media" }, { "category": "description", "text": "psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() and psd-tools export. decompress() already had a fallback that replaces failed channels with black pixels when result is None, but it never triggered because the ValueError from decode_rle() was not caught. The fix in version 1.12.2 wraps the decode_rle() call in a try/except so the existing fallback handles the error gracefully.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-27809" }, { "category": "description", "text": "Affected versions of the psd-tools package are vulnerable to Denial of Service (DoS) due to unbounded zlib decompression of ZIP-compressed channel data. The psd_tools.compression.decompress() logic in src/psd_tools/compression/__init__.py calls zlib.decompress(data) for Compression.ZIP and Compression.ZIP_WITH_PREDICTION without enforcing a maximum output length, allowing decompression to expand far beyond any expected buffer size.", "title": "pyupio - https://pyupio.github.io/safety-db/#psd-tools" }, { "category": "other", "text": "0.00049", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "6.8", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.0", "title": "NCSC Score" }, { "category": "other", "text": "Is related to an uncommon cwe id", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to a product by vendor Unknown, There is exploit data available from source Nvd, There is cwe data available from source Nvd, Exploit code publicly available", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5723111", "CSAFPID-4563051", "CSAFPID-4563052", "CSAFPID-4563053", "CSAFPID-4563054", "CSAFPID-4563055", "CSAFPID-4563056", "CSAFPID-4563057", "CSAFPID-4563058", "CSAFPID-4563059", "CSAFPID-4563060", "CSAFPID-4563061", "CSAFPID-4563062", "CSAFPID-4563063", "CSAFPID-4563064", "CSAFPID-4563065", "CSAFPID-4563066", "CSAFPID-4563067", "CSAFPID-4563068", "CSAFPID-4563069", "CSAFPID-4563070", "CSAFPID-4563071", "CSAFPID-4563072", "CSAFPID-4563073", "CSAFPID-4563074", "CSAFPID-4563075", "CSAFPID-4563076", "CSAFPID-4563077", "CSAFPID-4563078", "CSAFPID-4563079", "CSAFPID-4563080", "CSAFPID-4563081", "CSAFPID-4563082", "CSAFPID-4563083", "CSAFPID-4563084", "CSAFPID-4563085", "CSAFPID-4563086", "CSAFPID-4563087", "CSAFPID-4563088", "CSAFPID-4563089", "CSAFPID-4563090", "CSAFPID-4563091", "CSAFPID-4563092", "CSAFPID-4563093", "CSAFPID-4563094", "CSAFPID-4563095", "CSAFPID-4563096", "CSAFPID-4563097", "CSAFPID-4563098", "CSAFPID-4563099", "CSAFPID-4563100", "CSAFPID-4563101", "CSAFPID-4563102", "CSAFPID-5729639", "CSAFPID-5729640", "CSAFPID-5729641", "CSAFPID-5729642", "CSAFPID-5729643", "CSAFPID-5729644", "CSAFPID-5729645", "CSAFPID-5729646", "CSAFPID-5729647", "CSAFPID-5729648", "CSAFPID-5729649", "CSAFPID-5729650", "CSAFPID-5729651", "CSAFPID-5729652", "CSAFPID-5729653", "CSAFPID-5729654", "CSAFPID-5729655", "CSAFPID-5729656", "CSAFPID-5729657", "CSAFPID-5729658", "CSAFPID-5729659", "CSAFPID-5729660", "CSAFPID-5729661", "CSAFPID-5729662", "CSAFPID-5729663", "CSAFPID-5729664", "CSAFPID-5729665", "CSAFPID-5729666", "CSAFPID-5729667", "CSAFPID-5729668", "CSAFPID-5729669", "CSAFPID-5729670", "CSAFPID-5729671", "CSAFPID-5729672", "CSAFPID-5729673", "CSAFPID-5729674", "CSAFPID-5729675", "CSAFPID-5729676", "CSAFPID-5729677", "CSAFPID-5729678", "CSAFPID-5729679", "CSAFPID-5729680", "CSAFPID-5729681", "CSAFPID-5729682", "CSAFPID-5729683", "CSAFPID-5729684", "CSAFPID-5729685", "CSAFPID-5729686", "CSAFPID-5729687", "CSAFPID-4820512", "CSAFPID-4820513", "CSAFPID-4820514", "CSAFPID-4820515", "CSAFPID-4820516", "CSAFPID-4820517", "CSAFPID-5731716", "CSAFPID-5731717", "CSAFPID-5731718", "CSAFPID-5731719", "CSAFPID-5731720", "CSAFPID-5731721", "CSAFPID-5731722", "CSAFPID-5731723", "CSAFPID-5731724", "CSAFPID-5731725", "CSAFPID-5731726", "CSAFPID-5731727", "CSAFPID-5731728", "CSAFPID-5731729", "CSAFPID-5731730", "CSAFPID-5731731", "CSAFPID-5731732", "CSAFPID-5731733", "CSAFPID-5731734", "CSAFPID-5731735", "CSAFPID-5731736", "CSAFPID-5731737", "CSAFPID-5731738", "CSAFPID-5731739", "CSAFPID-5731740", "CSAFPID-5731741", "CSAFPID-5731742", "CSAFPID-5731743", "CSAFPID-5731744", "CSAFPID-5731745", "CSAFPID-5731746", "CSAFPID-5731747", "CSAFPID-5731748", "CSAFPID-5731749", "CSAFPID-5731750", "CSAFPID-5731751", "CSAFPID-5731752", "CSAFPID-5731753", "CSAFPID-5731754", "CSAFPID-5731755", "CSAFPID-5731756", "CSAFPID-5731757", "CSAFPID-5731758", "CSAFPID-5731759", "CSAFPID-5731760", "CSAFPID-5731761", "CSAFPID-5731762", "CSAFPID-5731763", "CSAFPID-5731764", "CSAFPID-5731765", "CSAFPID-5731766", "CSAFPID-5731767", "CSAFPID-5731768", "CSAFPID-5731769", "CSAFPID-5731770", "CSAFPID-5731771", "CSAFPID-5731772", "CSAFPID-5731773", "CSAFPID-5731774", "CSAFPID-5731775", "CSAFPID-5731776", "CSAFPID-5731777", "CSAFPID-5731778", "CSAFPID-5731779", "CSAFPID-5731780", "CSAFPID-5731781", "CSAFPID-5731782", "CSAFPID-5731783", "CSAFPID-5733944", "CSAFPID-5753657", "CSAFPID-5754431" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27809" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-27809" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27809" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/27xxx/CVE-2026-27809.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-27809.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27809" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-24p2-j2jr-386w" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-24p2-j2jr-386w" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-24p2-j2jr-386w.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-27809" }, { "category": "external", "summary": "Source - pyupio", "url": "https://pyupio.github.io/safety-db/#psd-tools" }, { "category": "external", "summary": "Source raw - pyupio", "url": "https://raw.githubusercontent.com/pyupio/safety-db/refs/heads/master/data/insecure_full.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/psd-tools/psd-tools/commit/6c0a78f195b5942757886a1863793fd5946c1fb1" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/psd-tools/psd-tools/releases/tag/v1.12.2" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/psd-tools/psd-tools/security/advisories/GHSA-24p2-j2jr-386w" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27809.json" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27809" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-24p2-j2jr-386w" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-4563051", "CSAFPID-4563052", "CSAFPID-4563053", "CSAFPID-4563054", "CSAFPID-4563055", "CSAFPID-4563056", "CSAFPID-4563057", "CSAFPID-4563058", "CSAFPID-4563059", "CSAFPID-4563060", "CSAFPID-4563061", "CSAFPID-4563062", "CSAFPID-4563063", "CSAFPID-4563064", "CSAFPID-4563065", "CSAFPID-4563066", "CSAFPID-4563067", "CSAFPID-4563068", "CSAFPID-4563069", "CSAFPID-4563070", "CSAFPID-4563071", "CSAFPID-4563072", "CSAFPID-4563073", "CSAFPID-4563074", "CSAFPID-4563075", "CSAFPID-4563076", "CSAFPID-4563077", "CSAFPID-4563078", "CSAFPID-4563079", "CSAFPID-4563080", "CSAFPID-4563081", "CSAFPID-4563082", "CSAFPID-4563083", "CSAFPID-4563084", "CSAFPID-4563085", "CSAFPID-4563086", "CSAFPID-4563087", "CSAFPID-4563088", "CSAFPID-4563089", "CSAFPID-4563090", "CSAFPID-4563091", "CSAFPID-4563092", "CSAFPID-4563093", "CSAFPID-4563094", "CSAFPID-4563095", "CSAFPID-4563096", "CSAFPID-4563097", "CSAFPID-4563098", "CSAFPID-4563099", "CSAFPID-4563100", "CSAFPID-4563101", "CSAFPID-4563102", "CSAFPID-4820512", "CSAFPID-4820513", "CSAFPID-4820514", "CSAFPID-4820515", "CSAFPID-4820516", "CSAFPID-4820517", "CSAFPID-5723111", "CSAFPID-5729639", "CSAFPID-5729640", "CSAFPID-5729641", "CSAFPID-5729642", "CSAFPID-5729643", "CSAFPID-5729644", "CSAFPID-5729645", "CSAFPID-5729646", "CSAFPID-5729647", "CSAFPID-5729648", "CSAFPID-5729649", "CSAFPID-5729650", "CSAFPID-5729651", "CSAFPID-5729652", "CSAFPID-5729653", "CSAFPID-5729654", "CSAFPID-5729655", "CSAFPID-5729656", "CSAFPID-5729657", "CSAFPID-5729658", "CSAFPID-5729659", "CSAFPID-5729660", "CSAFPID-5729661", "CSAFPID-5729662", "CSAFPID-5729663", "CSAFPID-5729664", "CSAFPID-5729665", "CSAFPID-5729666", "CSAFPID-5729667", "CSAFPID-5729668", "CSAFPID-5729669", "CSAFPID-5729670", "CSAFPID-5729671", "CSAFPID-5729672", "CSAFPID-5729673", "CSAFPID-5729674", "CSAFPID-5729675", "CSAFPID-5729676", "CSAFPID-5729677", "CSAFPID-5729678", "CSAFPID-5729679", "CSAFPID-5729680", "CSAFPID-5729681", "CSAFPID-5729682", "CSAFPID-5729683", "CSAFPID-5729684", "CSAFPID-5729685", "CSAFPID-5729686", "CSAFPID-5729687", "CSAFPID-5731716", "CSAFPID-5731717", "CSAFPID-5731718", "CSAFPID-5731719", "CSAFPID-5731720", "CSAFPID-5731721", "CSAFPID-5731722", "CSAFPID-5731723", "CSAFPID-5731724", "CSAFPID-5731725", "CSAFPID-5731726", "CSAFPID-5731727", "CSAFPID-5731728", "CSAFPID-5731729", "CSAFPID-5731730", "CSAFPID-5731731", "CSAFPID-5731732", "CSAFPID-5731733", "CSAFPID-5731734", "CSAFPID-5731735", "CSAFPID-5731736", "CSAFPID-5731737", "CSAFPID-5731738", "CSAFPID-5731739", "CSAFPID-5731740", "CSAFPID-5731741", "CSAFPID-5731742", "CSAFPID-5731743", "CSAFPID-5731744", "CSAFPID-5731745", "CSAFPID-5731746", "CSAFPID-5731747", "CSAFPID-5731748", "CSAFPID-5731749", "CSAFPID-5731750", "CSAFPID-5731751", "CSAFPID-5731752", "CSAFPID-5731753", "CSAFPID-5731754", "CSAFPID-5731755", "CSAFPID-5731756", "CSAFPID-5731757", "CSAFPID-5731758", "CSAFPID-5731759", "CSAFPID-5731760", "CSAFPID-5731761", "CSAFPID-5731762", "CSAFPID-5731763", "CSAFPID-5731764", "CSAFPID-5731765", "CSAFPID-5731766", "CSAFPID-5731767", "CSAFPID-5731768", "CSAFPID-5731769", "CSAFPID-5731770", "CSAFPID-5731771", "CSAFPID-5731772", "CSAFPID-5731773", "CSAFPID-5731774", "CSAFPID-5731775", "CSAFPID-5731776", "CSAFPID-5731777", "CSAFPID-5731778", "CSAFPID-5731779", "CSAFPID-5731780", "CSAFPID-5731781", "CSAFPID-5731782", "CSAFPID-5731783", "CSAFPID-5733944", "CSAFPID-5753657", "CSAFPID-5754431" ] } ], "title": "CVE-2026-27809" } ] }