CVE-2026-104062
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and…
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashe…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.7 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
Original description
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
Last activity 30 Oct 2026. Patch Forecast updates every hour.