{"id":"CVE-2026-104066","kind":"vulnerability","aliases":["CVE-2026-104066"],"related":[],"title":"Scribus: crafted Mac PICT image overflows heap memory during import","description":"Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.","summary":"Scribus, a desktop publishing app, has a heap buffer overflow in its Mac PICT image loader when it unpacks 4-bit indexed pixel data. A crafted PICT file with inconsistent width and row data can write out of bounds when placed or imported, causing crashes or code execution.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-publishing","macos","other","scribus"],"not_affected_if":["no-pict-import","scribus-1.6.7-or-later"],"how_to_check":"- Compare the installed Scribus version against `1.6.7`; anything earlier is listed as affected.\n- Check whether users open or import PICT files in Scribus, since the flaw is in the PICT loader and import plugin.","fix":"- Scribus: upgrade to `1.6.7` or later.","status":"open","published_at":"2026-10-30T16:17:36+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:31:58+00:00","updated_at":"2026-10-30T16:31:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T16:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Scribus: upgrade to `1.6.7` or later.","reach":"local","title":"Scribus: crafted Mac PICT image overflows heap memory during import","impact":"high","summary":"Scribus, a desktop publishing app, has a heap buffer overflow in its Mac PICT image loader when it unpacks 4-bit indexed pixel data. A crafted PICT file with inconsistent width and row data can write out of bounds when placed or imported, causing crashes or code execution.","audience":"everyone","category":"other","nicknames":[],"who_cares":["scribus","desktop-publishing","macos"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Code may run on the user's machine after a crafted PICT file is imported.","analyst_note":"","how_to_check":"- Compare the installed Scribus version against `1.6.7`; anything earlier is listed as affected.\n- Check whether users open or import PICT files in Scribus, since the flaw is in the PICT loader and import plugin.","plain_action":"Update Scribus to version 1.6.7 or newer, and be careful about opening PICT image files from unknown sources until you do.","needs_analyst":false,"not_affected_if":["scribus-1.6.7-or-later","no-pict-import"],"who_is_affected":"Anyone running Scribus before 1.6.7 who imports or places Mac PICT files, especially files received from outside the team. Systems that never open PICT images through Scribus are not exposed through this flaw. The sources do not say whether other image formats or Scribus builds on other platforms are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001164,"input_tokens":4146,"output_tokens":1499,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104066':13A,16A '-2026':12A,15A '1.6.7':73C '4':42B,91C 'app':27B 'attack':96C 'bit':43B,92C 'bound':61B,117C 'buffer':31B,77C 'caus':66B,118C 'code':69B,121C 'contain':74C 'craft':2A,48B,100C 'crash':67B,119C 'cve':11A,14A 'data':46B,56B,95C,108C 'desktop':18B,25B 'desktop-publish':17B 'execut':70B,122C 'file':50B,102C 'heap':7A,30B,76C 'imag':5A,37B,84C 'import':10A,65B,87C,113C 'inconsist':52B,104C 'index':44B,93C 'loader':38B,85C 'mac':3A,35B,82C 'maco':20B 'memori':8A 'overflow':6A,32B,78C 'pict':4A,36B,49B,83C,101C 'pixel':45B,94C 'place':63B,111C 'plugin':88C 'publish':19B,26B 'row':55B,107C 'scribus':1A,22B,23B,71C 'suppli':98C 'unpack':41B,90C 'vulner':79C 'width':53B,105C 'write':58B,114C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Scribus before 1.6.7 who imports or places Mac PICT files, especially files received from outside the team. Systems that never open PICT images through Scribus are not exposed through this flaw. The sources do not say whether other image formats or Scribus builds on other platforms are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Scribus to version 1.6.7 or newer, and be careful about opening PICT image files from unknown sources until you do.","first_public_at":"2026-10-30T16:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104066","severity":null,"published_at":"2026-10-30T16:17:36+00:00","modified_at":"2026-10-30T16:17:36+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}