DEBIAN-CVE-2026-104061: High severity debian/scribus vulnerability

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

Affected Software

3 affected components

debian/scribus*

Event History

Oct 30, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Scribus who open, place, or import PSD files are exposed. Exploitation occurs in the context of the affected user's Scribus session, so the potential code execution would run as that user.

What does an attacker need to do to exploit it?

An attacker needs to craft a malicious PSD file and convince a user to place or import it into Scribus. No attacker privileges are required, but user interaction is required.

Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4.

What is the impact if exploitation succeeds?

The crafted PSD can trigger a heap out-of-bounds write, causing Scribus to crash and potentially allowing code execution as the user running Scribus.

DEBIAN-CVE-2026-104061: High severity debian/scribus vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Which Scribus versions are affected?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Which Scribus versions are affected?

What is the impact if exploitation succeeds?