CVE-2026-104062

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4

Description A heap buffer overflow exists in the PICT image loader and import plugin. This occurs when the software fails to check the bytesPerLine value, allowing an attacker to corrupt heap memory. By crafting a PICT file where bytesPerLine exceeds the QImage scanline size, a remote attacker can cause the application to crash or potentially execute arbitrary code with the privileges of the user.

Recommendations Update Scribus to version 1.6.7 or later. Update Scribus to version 1.7.4 or later.