DEBIAN-CVE-2026-104066: Buffer Overflow

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

Affected Software

3 affected components

debian/scribus*

Event History

Oct 30, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What user interaction is required for exploitation?

An attacker must provide a crafted PICT image file and a user must place or import it into Scribus. The issue is triggered while the Mac PICT image loader and import plugin unpack 4-bit indexed pixel data.

Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4.

What can a successful exploit do?

The crafted image can cause an out-of-bounds heap write. This can result in a crash or code execution.

DEBIAN-CVE-2026-104066: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

Which Scribus versions are affected?

What can a successful exploit do?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

Which Scribus versions are affected?

What can a successful exploit do?