CVE-2026-104062 in Scribus
Summary
by MITRE • 10/30/2026
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in versions of Scribus prior to 1.6.7 represents a critical heap-based buffer overflow within the application's PICT image loading subsystem. This flaw specifically targets the import plugin responsible for handling Microsoft Macintosh Picture (PICT) files, which are legacy graphics formats still encountered in various digital workflows. The root cause lies in insufficient validation of input data during the parsing process. Specifically, when a user supplies or imports a maliciously crafted PICT file, the application fails to verify that the bytesPerLine value contained within the image header is consistent with the allocated memory size for the QImage scanline. In graphics processing, the bytesPerLine parameter dictates the number of bytes used to represent one horizontal line of pixels in an image buffer. If this value exceeds the actual capacity of the pre-allocated heap memory region designated for that specific image data structure, subsequent write operations will overflow beyond the boundaries of the allocated block.
This technical flaw falls squarely under CWE-122, which describes a heap-based buffer overflow where writes occur past the end or beginning of an allocated heap object. The lack of bounds checking allows an attacker to overwrite adjacent memory structures on the heap with arbitrary data derived from the crafted PICT file. Such overwrites can corrupt critical metadata associated with other heap objects, including function pointers, exception handlers, or vtable entries. In a complex application like Scribus, which manages numerous dynamic allocations for text frames, vector graphics, and layout elements, this memory corruption creates an unstable execution environment that is highly susceptible to exploitation techniques aimed at controlling program flow.
The operational impact of this vulnerability extends beyond simple service disruption. While the immediate manifestation often results in a crash or denial of service due to segmentation faults triggered by accessing invalid memory addresses, the underlying heap corruption presents a severe risk of remote code execution. An attacker who can trick a user into opening a malicious document containing the crafted PICT image may achieve arbitrary code execution with the privileges of the current user process. This aligns with ATT&CK technique T1203, which covers exploitation for client-side execution, as well as techniques related to memory corruption such as T1498 (Network Denial of Service) if exploited solely for disruption, though the primary threat vector is code execution via heap spraying or structure overwrite attacks. The severity is compounded by the fact that Scribus users frequently open documents from external sources, making social engineering a viable attack surface where an attacker might distribute a malicious document through email or file-sharing platforms to induce the victim to load the compromised image.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary defense is upgrading to Scribus version 1.6.7 or later, where this specific validation logic has been corrected to ensure that bytesPerLine does not exceed the allocated scanline size before memory operations are performed. For environments unable to upgrade immediately, implementing strict input sanitization at any proxy layer handling document uploads can help filter out malformed PICT files based on header anomalies. Furthermore, developers should enforce robust bounds checking in all image parsing modules and utilize modern compiler features such as stack protectors and heap hardening options like ASan (AddressSanitizer) during development to detect similar issues early. Users are advised to exercise caution when opening documents from untrusted sources and to maintain up-to-date security patches for their office productivity software to minimize the window of exposure to memory corruption exploits.