UBUNTU-CVE-2026-104066: Buffer Overflow
Published Nov 3, 2026
·Updated
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
Affected Software
7 affected components
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Scribus versions require remediation?
Scribus versions before 1.6.7 and 1.7.x versions before 1.7.4 are affected.
2
What must occur for exploitation to be possible?
A user must place or import a crafted Mac PICT image file. The file uses inconsistent width and row data in 4-bit indexed pixel data to trigger the out-of-bounds write.
3
What is the potential impact of successful exploitation?
Successful exploitation can cause Scribus to crash or may allow code execution.