CVE-2026-104061: Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader

Q: Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The listed affected package targets are Ubuntu and Debian Scribus.

Q: What does an attacker need to do to exploit this issue?

An attacker needs to convince a user to place or import a crafted PSD image file in Scribus. No attacker account or elevated privileges are required, but user interaction is required.

Q: What is the likely impact if exploitation succeeds?

The crafted PSD can trigger a heap out-of-bounds write, corrupting process memory. This can cause Scribus to crash and may allow code execution with the privileges of the user running Scribus.

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

Other sources

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

— MITRE

Affected Software

11 affected components

debian/scribus*

debian/scribus<=1.5.8+dfsg-4, <=1.6.3+dfsg-0.2, <=1.6.6+dfsg-0.2

ubuntu/scribus*

Event History

Oct 30, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

Affected Software

Frequently Asked Questions

Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The listed affected package targets are Ubuntu and Debian Scribus.

What does an attacker need to do to exploit this issue?

An attacker needs to convince a user to place or import a crafted PSD image file in Scribus. No attacker account or elevated privileges are required, but user interaction is required.

What is the likely impact if exploitation succeeds?

The crafted PSD can trigger a heap out-of-bounds write, corrupting process memory. This can cause Scribus to crash and may allow code execution with the privileges of the user running Scribus.

CVE-2026-104061: Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader

Other sources

Affected Software

Event History

Frequently Asked Questions

Which Scribus versions are affected?

What does an attacker need to do to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which Scribus versions are affected?

What does an attacker need to do to exploit this issue?

What is the likely impact if exploitation succeeds?