EUVD-2026-114102
GHSA-j534-3694-g2r9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PICT file to user
-
DeliveryUser places or imports file in Scribus
-
ExploitLoader unpacks 4-bit indexed pixels
-
ExecutionInconsistent width triggers heap out-of-bounds write
-
ImpactCrash or arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim running Scribus before 1.6.7 to place or import a crafted Mac PICT (.pict/.pct) image file; the trigger is specifically the PICT image loader and the 'pct' import plugin unpacking 4-bit indexed pixel data when the file declares a width inconsistent with the actual row data, causing an out-of-bounds heap write. Limiting factors: exploitation is local (AV:L) and gated on user interaction (UI:P) - the user must actively open/place/import the malicious file; there is no network-facing or unattended vector, no elevated privileges are required (PR:N), and only versions prior to 1.6.7 are affected (the vendor commit adds bounds-checked copy lengths). |
| Impact | Signals point to a genuine but non-urgent code-execution risk rather than a mass-exploitation emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, 8.5) describes a local, user-interaction-dependent file-parsing flaw with high confidentiality/integrity/availability impact and no scope change - high severity driven by impact, not by remote reachability. There is no EPSS score, no CISA KEV listing, and no PoC or exploit reference in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', consistent with a patched, high-impact but interaction-gated bug rather than 'act_now'/'emergency'. The heap write out-of-bounds (CWE-787) is confirmed by the vendor commit diff, which replaces unchecked memcpy/pixel-unpack loops with bounded copy lengths - so the memory-corruption mechanism is well supported by evidence. Net: treat as a real patch-this-cycle priority for environments that open untrusted PICT files in Scribus, but the local AV and required user interaction make widespread automated exploitation unlikely. |
| Exploit ScenarioDerived | An attacker emails or hosts a malicious .pict file and convinces a Scribus user (version before 1.6.7) to place or import it into a document. The crafted file declares an inconsistent width versus actual row data for 4-bit indexed pixels, so the PICT loader writes past the allocated scanline buffer, producing a crash or potentially attacker-influenced code execution. No public exploit code is referenced in the available data; exploitation depends on the victim opening the file (UI:P/UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Heap buffer overflow in Scribus before 1.6.7, in both the Mac PICT image data loader and the pct import plugin, lets a crafted .pict/.pct file whose declared width is inconsistent with its actual row data write past the end of a heap buffer when the image is placed or imported, crashing Scribus or potentially achieving code execution. The attack is local and gated on user interaction: the victim must actively open, place, or import the malicious image (no privileges required, no network-facing or unattended vector), and no public exploit has been identified at time of analysis. Version 1.6.7 addresses the flaw by bounding copy lengths and nibble-expansion loops against the real scanline and source buffer sizes.
RemediationAI
Upgrade Scribus to 1.6.7 or later, which contains the bounds-checking fix for both affected code paths; the upstream patch is commit d667b3b1d38e1808721315dc976d67b72070f6b4 (vendor-released patch: 1.6.7), referenced from https://wiki.scribus.net/canvas/1.6.7_Release and https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking. Until the upgrade is applied, the practical control is to avoid opening, placing, or importing untrusted .pict/.pct files in Scribus, since exploitation requires the user to load the crafted image and there is no network-facing path; because the same defect exists in both the core loader and the pct import plugin, disabling the import plugin alone does not fully close the exposure. Given the local vector, the user-interaction requirement, and the absence of public exploit code, scheduling the upgrade within the coming week is appropriate.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable code lives in scribus/imagedataloaders/scimgdataloader_pict.cpp and scribus/plugins/import/pct/importpct.cpp, where PICT opcodes are unpacked into a Qt QImage. When handling pixmaps, the loader trusted the file-declared bytes-per-row value and pixCols, then called memcpy(image.scanLine(rr), img.data(), bytesPerLine) without verifying that bytesPerLine fit the destination scanline (image.bytesPerLine()) or the source buffer (img.size()). In the 4-bit indexed path each source byte was expanded into two destination bytes via a pointer that was never checked against the scanline end, so a file declaring a width larger than its actual row data produced an out-of-bounds heap write; the planar path similarly iterated pixCols without accounting for the component plane count (3 or 4), reading past the source data. This is CWE-787 (out-of-bounds write), reachable through both the core image data loader and the pct import plugin. The fix commit d667b3b1d38e1808721315dc976d67b72070f6b4 clamps copies with copyLen = min(bytesPerLine, img.size(), scanBytes), bounds the nibble expansion loop with outPos + 1 < scanBytes, introduces maxPix = min(pixCols, scanBytes/4) for 32-bit images, and limits the planar loop to srcLimit = img.size() - (planes - 1) * pixCols. The CPE cpe:2.3:a:scribus:scribus:*:*:*:*:*:*:*:* maps every Scribus release prior to 1.6.7 to the affected range.
Know when Scribus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation needs the user to open a crafted local PICT file, so AV:L and UI:R with PR:N; the heap overflow can yield code execution giving high C/I/A, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
Executive ViewAI
Scribus versions before 1.6.7 contain a heap buffer overflow vulnerability in the Mac PICT image loader and pct import plugin. Successful exploitation requires a user to open a malicious .pict or .pct file, potentially leading to code execution on the affected system. This poses a risk to design teams using Scribus for desktop publishing, as an attacker could craft a file that compromises a user's workstation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Integer overflow in Scribus' TIFF tile loader (scimgdataloader_tiff) before 1.6.7 lets a crafted tiled TIFF corrupt heap
A heap buffer overflow in Scribus 1.6.x before 1.6.7 lets a crafted PICT/PCT file corrupt process memory when it is open
Out-of-bounds heap reads and writes in Scribus's SVM import plugin (importsvm) before 1.6.7 can crash the application or
Heap-based out-of-bounds write in Scribus's Micrografx Draw (.DRW) import plugin (importdrw) before 1.6.7 allows local a
Heap out-of-bounds write in Scribus before 1.6.7 can be triggered when a user opens, imports, or places a crafted Photos
Heap out-of-bounds reads in Scribus before 1.6.7 let a crafted Mac PICT/PCT image trigger a crash or leak bounded amount
Exploit-DB