Out-of-Bounds Read Vulnerability in Scribus Image Loader from Scribus Project

CVE-2026-104063

What is CVE-2026-104063?

Scribus versions prior to 1.6.7 are vulnerable to an out-of-bounds read issue within the Mac PICT image loader and import plugin. This vulnerability allows an attacker to craft a specially manipulated PICT file containing incorrect dimensions. When this malicious file is imported, it can trigger heap over-reads, which may lead to application crashes or unintentional disclosure of heap memory contents, posing a security risk to the affected systems.

References