CVE-2026-104061

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4

Description A heap out-of-bounds write issue exists in the scimgdataloader psd loader. The problem occurs because the loader uses unchecked PSD file values as lookup array indexes. An attacker can exploit this by tricking a user into importing or placing a specially crafted PSD file, which leads to heap memory corruption. This may result in application crashes or potential arbitrary code execution with the privileges of the user.

Recommendations Update to version 1.6.7 or later. Update to version 1.7.4 or later.