7.8
HighCVSS 3.1 · from VulnCheck
CVE-2026-104066
Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking
Scribus · Out-of-bounds write · CWE-787AffectedScribus
FixUpdate to 1.6.7 or newer
PublishedOct 30, 15:15 · VulnCheck
ScoredOct 30 · 7.8 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inScribusbefore 1.6.71.6.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known