Live › vulnerability › CVE-2026-104062
Scribus, a desktop page layout program, has a heap buffer overflow in its PICT image loader and import plugin. A crafted PICT file that is placed or imported can crash Scribus and may run code as the user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Anyone who runs a Scribus version before 1.6.7 and places or imports PICT image files, especially files from unknown sources. The sources do not describe server-side or automated exposure. Teams that do not use Scribus on their machines can skip it.
No product ranges from the sources yet.
scribus --version and compare the result with the fixed version below.1.6.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
This page as .md · .json · in your agent: get_signal("CVE-2026-104062")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.