Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Scribus
  • Scribus

No data.

No data.

References
Link Providers
https://github.com/scribusproject/scribus cve-icon cve-icon
https://github.com/scribusproject/scribus/commit/cca3e4991dd199c103edb4a3bc5351f5cb88d62b cve-icon cve-icon
https://github.com/scribusproject/scribus/commit/d61e7ac5879a6d9dc23113eff2fe0007f398eadc cve-icon cve-icon
https://wiki.scribus.net/canvas/1.6.7_Release cve-icon cve-icon
https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-psd-image-loader cve-icon cve-icon
History

Mon, 02 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user. Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Title Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via PSD Image Loader
References

Fri, 30 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Scribus
Scribus scribus
Vendors & Products Scribus
Scribus scribus

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Title Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-30T15:15:56.127Z

Updated: 2026-11-02T20:37:47.393Z

Reserved: 2026-10-01T18:02:50.081Z

Link: CVE-2026-104061

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T16:17:35.250

Modified: 2026-11-02T21:17:21.273

Link: CVE-2026-104061

cve-icon Redhat

No data.