CVE-2026-104063

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4

Description An out-of-bounds read exists in the Mac PICT image loader and import plugin during the decoding of planar pixel data. A remote attacker can provide a specially crafted PICT file with manipulated dimensions that, when imported or placed, triggers heap over-reads. This can result in application crashes or the disclosure of sensitive heap memory.

Recommendations Update Scribus to version 1.6.7 or later. Update Scribus to version 1.7.4 or later.