CVE-2026-104066: Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Q: What user interaction is required for exploitation?

An attacker must provide a crafted PICT image, and a user must place or import that file into Scribus. The supplied severity vector indicates local attack access and required user interaction.

Q: Which installations are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The listed software includes Ubuntu and Debian Scribus packages.

Q: What is the potential impact after a malicious file is imported?

The out-of-bounds heap write can cause Scribus to crash or may allow code execution. Confidentiality, integrity, and availability impacts are all rated high in the provided severity vector.

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

Other sources

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

— NVD

Affected Software

11 affected components

debian/scribus*

debian/scribus<=1.5.8+dfsg-4, <=1.6.3+dfsg-0.2, <=1.6.6+dfsg-0.2

ubuntu/scribus*

Event History

Oct 30, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

Affected Software

Frequently Asked Questions

What user interaction is required for exploitation?

An attacker must provide a crafted PICT image, and a user must place or import that file into Scribus. The supplied severity vector indicates local attack access and required user interaction.

Which installations are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The listed software includes Ubuntu and Debian Scribus packages.

What is the potential impact after a malicious file is imported?

The out-of-bounds heap write can cause Scribus to crash or may allow code execution. Confidentiality, integrity, and availability impacts are all rated high in the provided severity vector.

CVE-2026-104066: Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Other sources

Affected Software

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

Which installations are affected?

What is the potential impact after a malicious file is imported?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

Which installations are affected?

What is the potential impact after a malicious file is imported?