CVE-2026-104062

High

Description

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

SeverityHigh

CVSS7.8

Exploit probability—

ProductScribus

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-787Out-of-bounds write

How to fix

Update

Scribus Scribus1.6.7, 1.7.4 or later

Patches

Vendor advisories

wiki.scribus.net/canvas/1.6.7_Release

Affected products

Product	Affected versions	Fixed in
Scribus Scribus	v < 1.6.7, 1.7.0 ≤ v < 1.7.4	1.6.7, 1.7.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.