Answer in brief
CVE-2020-10571 records a Critical severity (CVSS 9.8) vulnerability in Potential buffer overflow in psd-tools. The current sources do not mark it as known exploited. The current feed maps psd-tools (pip), psd-tools (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps psd-tools (pip), psd-tools (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| psd-toolspip | >=1.8.37,<=1.9.3 | 1.9.4 |
| psd-toolspypi | >=1.8.37 <1.9.4 | 1.9.4 |
Published upstream
Mar 16, 2020
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 24, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
### Impact An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow. ### Patches Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4. ### Workarounds Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded. ### References https://github.com/psd-tools/psd-tools/pull/198 ### For more information If you have any questions or comments about this advisory: * Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)
Quoted source text, attributed separately from HOL analysis.