{"id":"CVE-2026-104063","kind":"vulnerability","aliases":["CVE-2026-104063"],"related":[],"title":"Scribus: crafted Mac PICT file leaks heap memory or crashes the app","description":"Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","summary":"Scribus before 1.6.7 reads past the end of a buffer in its Mac PICT image loader when decoding planar pixel data. A crafted PICT file with manipulated dimensions can crash Scribus or expose heap memory contents.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","image-import","package","scribus"],"not_affected_if":["no-pict-import","scribus-1.6.7-or-later"],"how_to_check":"- Check the installed Scribus version, for example with `scribus --version`, and see whether it is below `1.6.7`.\n- Note whether any users import PICT files into Scribus.","fix":"- Scribus: move to `1.6.7` or later.","status":"open","published_at":"2026-10-30T16:17:35+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:16+00:00","updated_at":"2026-10-30T16:32:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T16:32:16Z","model":"claude-haiku-5-5","output":{"fix":"- Scribus: move to `1.6.7` or later.","reach":"local","title":"Scribus: crafted Mac PICT file leaks heap memory or crashes the app","impact":"low","summary":"Scribus before 1.6.7 reads past the end of a buffer in its Mac PICT image loader when decoding planar pixel data. A crafted PICT file with manipulated dimensions can crash Scribus or expose heap memory contents.","audience":"everyone","category":"package","nicknames":[],"who_cares":["scribus","desktop","image-import"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Crash of Scribus or leak of heap memory contents","analyst_note":"","how_to_check":"- Check the installed Scribus version, for example with `scribus --version`, and see whether it is below `1.6.7`.\n- Note whether any users import PICT files into Scribus.","plain_action":"Update Scribus to version 1.6.7 or later if you use it to open or import Mac PICT images.","needs_analyst":false,"not_affected_if":["scribus-1.6.7-or-later","no-pict-import"],"who_is_affected":"Anyone who opens or places PICT image files in Scribus versions before 1.6.7, most likely on desktop machines used for layout or publishing. Teams that never import PICT files and do not open untrusted documents are at lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4145,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104063':15A,18A '-2026':14A,17A '1.6.7':27B,63C 'app':12A 'attack':86C 'bound':69C 'buffer':34B 'caus':101C 'contain':64C 'content':60B 'craft':2A,47B,90C 'crash':10A,54B,108C 'cve':13A,16A 'data':45B,85C 'decod':42B,82C 'desktop':19B 'dimens':52B,95C 'disclosur':112C 'end':31B 'expos':57B 'file':5A,49B,92C 'heap':7A,58B,102C,110C 'imag':21B,39B,76C 'image-import':20B 'import':22B,79C,100C 'lead':106C 'leak':6A 'loader':40B,77C 'mac':3A,37B,74C 'manipul':51B,94C 'memori':8A,59B,111C 'out-of-bound':66C 'over-read':103C 'packag':23B 'past':29B 'pict':4A,38B,48B,75C,91C 'pixel':44B,84C 'place':98C 'planar':43B,83C 'plugin':80C 'read':28B,70C,105C 'scribus':1A,24B,25B,55B,61C 'suppli':88C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens or places PICT image files in Scribus versions before 1.6.7, most likely on desktop machines used for layout or publishing. Teams that never import PICT files and do not open untrusted documents are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Scribus to version 1.6.7 or later if you use it to open or import Mac PICT images.","first_public_at":"2026-10-30T16:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104063","severity":null,"published_at":"2026-10-30T16:17:35+00:00","modified_at":"2026-10-30T16:17:35+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}