Heap Buffer Overflow in Scribus Image Loader

CVE-2026-104062

What is CVE-2026-104062?

Scribus, prior to version 1.6.7, is susceptible to a heap buffer overflow due to a flaw in the PICT image loader. This vulnerability enables attackers to corrupt heap memory by providing an unchecked 'bytesPerLine' value in a crafted PICT file. If the 'bytesPerLine' exceeds the allowed QImage scanline size, it can cause Scribus to crash during image loading or importing. This behavior not only disrupts the application's functionality but may also allow unauthorized code execution in the context of the user, posing serious security risks.

References