[ CVE-2026-104062 · Published 30 Oct 2026 ]
Vulnerability in Scribus
CVSS 7.8
EPSS <1%No fix listed yet
[ Description ]Official description
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/scribusproject/scribus
- github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f
- github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4
- wiki.scribus.net/canvas/1.6.7_Release
- www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-pixmap-…