CVE-2026-104063
Received Received - Intake

Out-of-Bounds Read in Scribus via Malicious PICT File

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-104063
EUVD
EUVD-2026-114099

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Scribus Scribus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Scribus before version 1.6.7 has an out-of-bounds read vulnerability in the Mac PICT image loader. When decoding planar pixel data from a crafted PICT file with manipulated dimensions, it causes heap over-reads. This can lead to crashes or disclosure of heap memory.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable Scribus versions and inspecting files for crafted PICT images. Use commands like 'scribus --version' to check installed version. Scan imported or project files for PICT images with manipulated dimensions. No direct network detection commands are provided.

Impact Analysis

Attackers could exploit this to crash Scribus or access sensitive memory contents. If successful, it may allow unauthorized data exposure or denial-of-service conditions when processing malicious PICT files.

Mitigation Strategies

Immediately update Scribus to version 1.6.7 or later. Avoid importing untrusted PICT files. If using older versions, disable the Mac PICT image loader plugin if possible. Monitor for crashes or memory disclosure when handling PICT files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart