ag-psd is a JavaScript library that reads and writes Photoshop Document files. The vulnerability allows an attacker to declare extraordinarily large PSD geometry that causes the library to allocate several gigabytes of memory before performing bounds checks. This uncontrolled memory allocation can lead to denial of service by exhausting process memory, causing the Node.js runtime to be killed or crash before the error is handled. The weakness is a classic example of CWE-789: Uncontrolled Memory Allocation.

Agamnentzar’s ag-psd library for JavaScript is affected. Versions prior to 31.0.0 contain the flaw, as the feature that limits composite-image allocation is introduced in 31.0.0 but does not fully cover the layer-rectangle allocation path. Any deployment that loads untrusted PSD files via readPsd() in these older versions is vulnerable.

With a CVSS score of 7.5, the vulnerability presents a high severity condition, but the EPSS score is not available and the instance is not listed in the CISA KEV catalog. The exploit requires the execution of arbitrary PSD files within the context of an application that invokes readPsd(); a carefully crafted 52‑byte payload can trigger more than 3 GB of peak RSS in Node 24, leading to process termination before the issue is detected. The attack vector is likely a library-facing service or internal script that accepts PSD input, as no network‑direct exposure is mentioned; nevertheless, any environment that processes untrusted documents is at risk. While the remediation in 31.0.0 mitigates composite-image allocations, the layer‑rectangle path remains incomplete, so the risk persists until full coverage is verified.