Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104063: Scribus can crash or leak memory via crafted PICT file

CVE-2026-104063 · published 5 days ago

Summary

Versions of Scribus earlier than 1.6.7 and earlier than 1.7.4 on macOS may read beyond the intended memory area when opening a specially crafted PICT image. This can cause the program to crash or reveal parts of its memory, potentially exposing sensitive information. Upgrade Scribus to version 1.6.7 or 1.7.4 (or later) to fix the issue.

What to do

Update scribus scribus to version 1.6.7 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	scribus	All versions
–	scribus	scribus	< 1.6.7
Ubuntu:16.04:LTS	canonical	scribus	All versions

Original advisory text

Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image Data

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.

References

https://github.com/scribusproject/scribus Product
https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b... Patch
https://wiki.scribus.net/canvas/1.6.7_Release Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1040... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-104063 Vendor Advisory
https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef2... Patch
https://security-tracker.debian.org/tracker/CVE-2026-104063 Vendor Advisory
https://ubuntu.com/security/CVE-2026-104063 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-104063 Third Party Advisory
https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-read-via... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published30 Oct 2026

Updated4 Nov 2026

First seen30 Oct 2026

Sources

CVE-2026-104063 · NVD

CVE-2026-104063 · MITRE

CVE-2026-104063 · OSV

DEBIAN-CVE-2026-104063 · OSV

UBUNTU-CVE-2026-104063 · OSV

Track software like this

Free during beta