CVE-2026-104062: Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Loader

Q: Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a crafted PICT image with a bytesPerLine value larger than the QImage scanline size and persuade the user to place or import it into Scribus. No attacker privileges are required, but user interaction is required.

Q: What is the likely impact if exploitation succeeds?

The malformed PICT file can corrupt heap memory, causing Scribus to crash and potentially allowing code execution in the context of the user running Scribus.

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

Other sources

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

— NVD

Affected Software

11 affected components

debian/scribus*

debian/scribus<=1.5.8+dfsg-4, <=1.6.3+dfsg-0.2, <=1.6.6+dfsg-0.2

ubuntu/scribus*

Event History

Oct 30, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

Affected Software

Frequently Asked Questions

Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4.

What does an attacker need to exploit this issue?

An attacker needs to provide a crafted PICT image with a bytesPerLine value larger than the QImage scanline size and persuade the user to place or import it into Scribus. No attacker privileges are required, but user interaction is required.

What is the likely impact if exploitation succeeds?

The malformed PICT file can corrupt heap memory, causing Scribus to crash and potentially allowing code execution in the context of the user running Scribus.

CVE-2026-104062: Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Loader

Other sources

Affected Software

Event History

Frequently Asked Questions

Which Scribus versions are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which Scribus versions are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?