CVE-2026-104063

6.1 MEDIUMpublic exploit available

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weaknesses

CWE-125

Public exploit & PoC references

https://github.com/scribusproject/scribus
https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4

All references

https://github.com/scribusproject/scribus
https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4
https://wiki.scribus.net/canvas/1.6.7_Release
https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-read-via-pict-planar-image-data

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2024-58392PoC
MEDIUMCVE-2024-58397PoC
MEDIUMCVE-2024-58399PoC
MEDIUMCVE-2025-60494PoC
MEDIUMCVE-2025-71438PoC
MEDIUMCVE-2025-71439PoC
MEDIUMCVE-2026-100126
MEDIUMCVE-2026-100130

Related by shared AI tags and CWE weakness class. Browse the full archive.