Live › vulnerability › CVE-2026-104066
Scribus, a desktop publishing app, has a heap buffer overflow in its Mac PICT image loader when it unpacks 4-bit indexed pixel data. A crafted PICT file with inconsistent width and row data can write out of bounds when placed or imported, causing crashes or code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Anyone running Scribus before 1.6.7 who imports or places Mac PICT files, especially files received from outside the team. Systems that never open PICT images through Scribus are not exposed through this flaw. The sources do not say whether other image formats or Scribus builds on other platforms are affected.
No product ranges from the sources yet.
1.6.7; anything earlier is listed as affected.1.6.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-104066")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.