PT-2026-133616
CVE-2026-104061
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Found an issue in the description? Have something to add? Feel free to write us 👾