UBUNTU-CVE-2026-104063: Medium severity ubuntu/scribus vulnerability
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ubuntu systems running affected Scribus versions are exposed when users place or import PICT image files. The issue is in the Mac PICT image loader and import plugin.
What does an attacker need to exploit it?
An attacker needs to provide a crafted PICT file with manipulated planar-pixel dimensions and have a user place or import that file in Scribus. No attacker privileges are required, but user interaction is required.
What is the impact of successful exploitation?
Processing the crafted image can cause heap out-of-bounds reads, resulting in a Scribus crash or disclosure of heap memory.
Which Scribus releases are affected?
Scribus versions before 1.6.7 and 1.7.x versions before 1.7.4 are affected.