Scribus CVE-2026-104063

The victim must open, place, or import a specially crafted PICT/PCT image whose header declares manipulated dimensions, which is then processed by the Mac PICT loader (ScImgDataLoader_PICT::handlePixmap) or the PCT import plugin (PctPlug::handlePixmap) while decoding planar pixel data - the code paths the patch guards with min() clamping and an image.isNull() check. Limiting factors that reduce real-world risk: exploitation requires user interaction to open/import the file (UI:P), the vector is local with no network-exposed service, it affects only Scribus versions before 1.6.7, and because it is a read-only out-of-bounds condition the outcome is a crash or bounded heap memory disclosure rather than code execution.

This is a moderate-priority, patch-in-normal-cycle issue rather than an emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) and the score of 6.9 both signal that exploitation is local and file-driven, not a remotely reachable network service: an attacker cannot trigger it without getting a victim to open, place, or import a crafted PICT file in Scribus. Impact is asymmetric - VA:H (the OOB read crashes the application) with only VC:L (bounded heap memory disclosure) and VI:N (no integrity impact), consistent with CWE-125 and the diff, which adds bounds clamping (std::min of bytesPerLine/img.size()/scanBytes) to a read/copy path but shows no attacker-controlled write primitive, so remote code execution is not indicated by the available evidence. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), matching a vendor-patched memory-disclosure/DoS bug in a desktop application. The SSVC-style signals are therefore internally consistent - medium severity, local attack surface, user interaction required - with no conflicting data, though the absence of EPSS/KEV means likelihood is inferred from attack surface rather than observed telemetry.

An attacker crafts a malicious PICT (Mac QuickDraw) image with manipulated planar-image dimensions and delivers it to a victim - for example as a shared design asset or email attachment. When the victim opens or imports/places that file in Scribus before 1.6.7, the planar pixel decoder over-reads heap memory, crashing the application or embedding adjacent heap bytes into the decoded image. No public exploit code was identified in the provided data.