CVE-2026-63501

Name of the Vulnerable Software and Affected Versions ag-psd versions prior to 31.0.3

Description The readPsd() function accepts a totalMemoryLimit for parsing files, but the decodeLayerImageData function expects a property named memoryLimit. This discrepancy causes an undefined limit to be passed to createImageDataBitDepth(), allowing an attacker to use controlled layer dimensions to trigger memory allocations exceeding the configured limit, leading to process memory exhaustion and denial of service. Additionally, the inflateSync(compressed) function decompresses ZIP-encoded channel data without an output-size cap, which can also result in denial of service through unbounded decompression.

Recommendations Update to version 31.0.3 or later.