Live › vulnerability › CVE-2026-104063
Scribus before 1.6.7 reads past the end of a buffer in its Mac PICT image loader when decoding planar pixel data. A crafted PICT file with manipulated dimensions can crash Scribus or expose heap memory contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Anyone who opens or places PICT image files in Scribus versions before 1.6.7, most likely on desktop machines used for layout or publishing. Teams that never import PICT files and do not open untrusted documents are at lower risk.
No product ranges from the sources yet.
scribus --version, and see whether it is below 1.6.7.1.6.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-104063")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.