The vulnerability resides in the compression module of the psd-tools Python package, where malformed RLE‑compressed image data can trigger an unhandled ValueError during decoding. The exception propagates to higher‑level functions like psd.composite() and export, resulting in an application crash. As the crash is not limited by authentication, a local attacker can easily cause denial of service by supplying a crafted PSD file, and a remote attacker could potentially exploit the flaw if the application processes user‑supplied PSD files without prior validation.

The affected product is psd-tools, a Python package used for handling Adobe Photoshop PSD files. All versions prior to 1.12.2 are vulnerable; version 1.12.2 and later contain the necessary fix.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of <1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malformed PSD file; no network‑remote exploit vector is documented. The lack of a network boundary, however, means that if the affected application accepts PSD files from untrusted sources, it could be exposed to a remote denial of service.