CVE-2026-104066
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and…
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.7 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
Original description
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
Last activity 30 Oct 2026. Patch Forecast updates every hour.