EUVD-2026-114098
GHSA-qqfg-r365-fmcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PICT file to victim
-
ExploitVictim opens or imports it in Scribus
-
ExecutionOversized bytesPerLine overflows scanline via memcpy
-
ImpactExecute code as the running user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or import (place) an attacker-crafted PICT/PCT file in Scribus before 1.6.7, so that the PICT pixmap loader (scribus/imagedataloaders/scimgdataloader_pict.cpp) or the pct import plugin (scribus/plugins/import/pct/importpct.cpp) processes it. The specific trigger condition is a PICT whose bytesPerLine value exceeds the destination QImage's scanline size (bytesPerLine()), causing memcpy into image.scanLine() to write past the allocated row. Limiting factors: this is a local (AV:L) attack needing user interaction (UI:P) - the file must be delivered and the user must choose to open or import it; there is no network-service exposure and no privilege prerequisite. Only versions before 1.6.7 are affected. |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.5) describes a local, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction (UI:P) - the victim must open or import a malicious PICT file. This is a client-side file-parsing bug, not a remotely reachable service vulnerability, which substantially limits mass exploitation. No EPSS score is provided in the input and the CVE is not on CISA KEV, so there is no signal of active or widespread exploitation; the only priority signal is vuln.today's 'this_week' Decision label. Impact is genuinely high - heap memory corruption (CWE-787) that may yield code execution with the running user's privileges - but realization depends on social engineering to deliver and have the user process the crafted file. Net assessment: a real priority to patch for anyone running Scribus that handles untrusted PICT files, but the local vector plus required user interaction make this a targeted/opportunistic client-exploitation risk rather than an internet-facing emergency. The source commit confirms the mechanism, so the technical impact rating is well grounded rather than speculative. |
| Exploit ScenarioDerived | An attacker crafts a PICT image whose bytesPerLine field exceeds the QImage scanline size and delivers it to a victim (e.g., via email, download, or a shared document asset). When the victim opens or imports the file in Scribus before 1.6.7, the PICT pixmap loader memcpy's the oversized row data past the allocated scanline, corrupting the heap and crashing Scribus, with the potential to execute code as the user. No public exploit is identified in the input, but the vendor patch diff publicly reveals the exact unchecked length used in the overflow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
A heap buffer overflow in Scribus 1.6.x before 1.6.7 lets a crafted PICT/PCT file corrupt process memory when it is opened or placed through the PICT image loader or the PCT import plugin. The root cause is an unchecked bytesPerLine value used as the memcpy length into a QImage scanline, so a file whose bytesPerLine exceeds the destination row size overflows the heap, crashing the application and potentially allowing code execution with the user's privileges. Exploitation requires the victim to open or import the malicious file (local attack, user interaction), and a public PoC reference exists via the VulnCheck advisory; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
RemediationAI
Upgrade to Scribus 1.6.7 or later, which contains commit d667b3b1d38e1808721315dc976d67b72070f6b4 bounding every memcpy and pixel loop by the destination QImage scanline size (release notes: https://wiki.scribus.net/canvas/1.6.7_Release; advisory: https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-pixmap-loader). The patch is available from the vendor and is the only complete fix described in the available sources. Until upgrading, treat untrusted PICT/PCT files as hostile - do not open or import PICT images from unknown or unverified sources in Scribus before 1.6.7, since the flaw is reached only through the user-initiated open/place/import action. The trigger conditions for partial-content configurations are not described in the available sources, so no more granular workaround can be stated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Scribus parses Apple PICT/PCT raster images in two places: the core image data loader (scribus/imagedataloaders/scimgdataloader_pict.cpp) and the import plugin (scribus/plugins/import/pct/importpct.cpp). In handlePixmap(), the PixMap opcode's attacker-controlled bytesPerLine field was passed unchanged to memcpy(image.scanLine(rr), img.data(), bytesPerLine), while the destination QImage was allocated with a different, smaller stride (image.bytesPerLine()). Where those values diverge, the copy writes past the end of the heap-allocated scanline - CWE-787, out-of-bounds write. Related unchecked indices existed in the unpacked-bits and multi-plane (component_count 3/4) paths, where loops iterated to img.size() or pixCols without bounding against the destination scanline. The upstream fix, commit d667b3b1d38e1808721315dc976d67b72070f6b4, adds a null-image guard, computes copyLen = std::min({bytesPerLine, img.size(), scanBytes}) before every memcpy, bounds the nibble-expansion loop with outPos + 1 < scanBytes, and clamps pixel loops with maxPix/rowPix derived from scanBytes/4 and the plane count. Affected per CPE: all scribus:scribus releases prior to 1.6.7.
Know when Scribus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened/imported locally by the user, so AV:L and UI:R; no privileges needed (PR:N), and heap corruption can yield user-context code execution, giving C:H/I:H/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
Executive ViewAI
Scribus versions 1.6.0 through 1.6.6 contain a memory corruption flaw triggered by opening or importing a specially crafted PICT image file, which could crash the application or allow an attacker to execute code with the victim's privileges. This impacts design and publishing teams using Scribus for document work, where opening shared image assets is routine, and a successful exploit could lead to unauthorized data access or disruption of creative workflows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Heap buffer overflow in Scribus before 1.6.7, in both the Mac PICT image data loader and the pct import plugin, lets a c
Integer overflow in Scribus' TIFF tile loader (scimgdataloader_tiff) before 1.6.7 lets a crafted tiled TIFF corrupt heap
Out-of-bounds heap reads and writes in Scribus's SVM import plugin (importsvm) before 1.6.7 can crash the application or
Heap-based out-of-bounds write in Scribus's Micrografx Draw (.DRW) import plugin (importdrw) before 1.6.7 allows local a
Heap out-of-bounds write in Scribus before 1.6.7 can be triggered when a user opens, imports, or places a crafted Photos
Heap out-of-bounds reads in Scribus before 1.6.7 let a crafted Mac PICT/PCT image trigger a crash or leak bounded amount
Exploit-DB