CVE-2026-104061 in Scribus
Summary
by MITRE • 10/30/2026
Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Scribus application prior to version 1.6.7 is susceptible to a critical heap-based buffer overflow vulnerability within its image processing subsystem, specifically located in the scimgdataloader_psd module responsible for handling Photoshop Document files. This flaw arises from an insufficient validation of input data when parsing PSD file headers and metadata structures. The loader fails to properly verify that values extracted from the crafted PSD file are within valid bounds before using them as indices to access internal lookup arrays or memory buffers. By manipulating specific fields in the PSD header, such as image size dimensions, channel counts, or compression method indicators, an attacker can supply integer values that exceed the allocated heap space for these data structures.
From a technical perspective, this vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Heap-based Overflow. The core issue lies in the lack of rigorous boundary checks during the parsing phase. When the application processes a maliciously constructed PSD file, it reads user-controlled values and directly applies them as offsets or indices into heap-allocated arrays. Because these inputs are not sanitized against the actual size of the allocated memory regions, writing data at these calculated addresses results in an out-of-bounds write operation. This corrupts adjacent heap metadata or other critical application state stored nearby in memory, leading to immediate instability and potential exploitation vectors that allow for arbitrary code execution with the privileges of the user running the Scribus instance.
The operational impact of this vulnerability is severe, as it enables remote code execution through social engineering tactics rather than requiring direct network access. An attacker can distribute a specially crafted PSD file via email, instant messaging, or web hosting services and convince a victim to open or import the file within Scribus. Upon loading the malicious document, the application triggers the vulnerable parsing routine, causing heap corruption that can be leveraged by an experienced attacker to execute arbitrary shellcode on the target system. This effectively compromises the confidentiality, integrity, and availability of the user's environment, potentially leading to full system compromise depending on the security context in which Scribus is executed.
This attack vector aligns with MITRE ATT&CK technique T1203, Exploitation for Client Execution, where adversaries exploit vulnerabilities in client applications like document viewers or editors to gain initial access. The vulnerability also reflects CWE-20 Improper Input Validation, as the root cause is the failure to validate and sanitize external data before processing it within a security-critical context. Defense mechanisms such as input validation at the application layer are insufficient if not implemented correctly; therefore, robust bounds checking must be enforced for all array index calculations derived from untrusted sources like file formats.
To mitigate this risk, organizations and individual users should immediately upgrade Scribus to version 1.6.7 or later, where these heap overflow issues have been addressed through improved input validation and memory safety checks in the PSD loader module. Additionally, implementing application whitelisting can restrict the execution of untrusted binaries, while sandboxing techniques can limit the potential impact if a vulnerability is successfully exploited by isolating the application from critical system resources. Regular security updates and patch management are essential to maintain resilience against such exploitation attempts targeting widely used desktop publishing software.