{"id":"EUVD-2026-116262","revision":"e27f7eafb80a467286d1cbe852eaefbb","records":[{"revision":"e27f7eafb80a467286d1cbe852eaefbb","observedAt":"2026-11-11T22:57:21.277+00:00","statement":{"source":"euvd","id":"EUVD-2026-116262","aliases":["CVE-2026-63501","GHSA-6w3r-6hpr-hp6p"],"title":"ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit propert…","description":"ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p","https://github.com/Agamnentzar/ag-psd/commit/57ea7d865238b6b7c8a2e976bcf2a77e03116e2f","https://github.com/Agamnentzar/ag-psd/releases/tag/31.0.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116262","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 3, 2026, 7:30:03 PM","dateUpdated":"Nov 3, 2026, 9:32:16 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-116262","identifiers":["EUVD-2026-116262","CVE-2026-63501","GHSA-6w3r-6hpr-hp6p"]},"retained":false,"historicalAffected":[]}],"coverage":[]}