Heap Buffer Overflow in Scribus Image Loader by Scribus Project

CVE-2026-104066

What is CVE-2026-104066?

The Scribus application contains a heap buffer overflow vulnerability in its Mac PICT image loader. When handling 4-bit indexed pixel data, this flaw allows attackers to craft specially designed PICT files with inconsistent width and row data. This discrepancy can lead to out-of-bounds writing, resulting in application crashes or even arbitrary code execution. Users are urged to upgrade to version 1.6.7 or later to mitigate risks associated with this vulnerability.

References