Scribus EUVD-2026-114097

Exploitation requires the victim to open, import or place a specially crafted Photoshop PSD file in Scribus, which routes through the scimgdataloader_psd PSD image loader; the crafted PSD must carry channel-count/component values that exceed the real channel count so they are used as out-of-range lookup-array indices (per the commit, header.channel_count and the components[5] index are what the fix clamps). Limiting factors that reduce realistic risk: the attack vector is local (AV:L) with no network exposure, it requires user interaction (UI:P) to load the file, it affects only Scribus installations before 1.6.7, and successful code execution runs only with the privileges of the user who opened the file (SC:N/SI:N/SA:N - no scope change).

The vendor-supplied CVSS 4.0 score of 8.5 (High) is driven by full technical impact (VC:H/VI:H/VA:H) combined with low attack complexity, no attacker privileges (PR:N) and no attack requirements (AT:N). However, the same vector sharply limits real-world risk: AV:L means there is no network-reachable attack surface, and UI:P requires the victim to open, place or import the malicious PSD into Scribus - this is a client-side, file-borne bug, not a remotely exploitable service flaw, so it is not automatable or wormable. Exploitation status is 'no public exploit identified at time of analysis': the input lists no CISA KEV entry, no EPSS probability, and no PoC/exploit reference (only the patch commit, the project repo, release notes and the VulnCheck advisory). The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-user-interaction-gated memory-corruption bug rather than an actively-exploited priority. Net assessment: a genuine high-severity heap out-of-bounds write with plausible code-execution impact, but the local vector plus required user interaction make it a patch-this-cycle item rather than a drop-everything emergency. Missing signals to note explicitly: EPSS score is absent, so statistical exploitation likelihood cannot be compared; KEV status is not listed (no confirmed active exploitation).

An attacker crafts a malicious PSD file whose header channel-count/component values are set to out-of-range numbers and distributes it (e.g. as a shared design asset, email attachment or download). When a Scribus user before 1.6.7 imports or places that PSD, the scimgdataloader_psd loader uses the attacker-controlled values as array indices, writing past the bounds of a heap buffer, which can crash the application or potentially execute code with the user's privileges. No public working exploit is identified; impact is bounded by the need for the victim to open the file locally.