{"id":"CVE-2026-104063","aliases":["DEBIAN-CVE-2026-104063","EUVD-2026-114099","GHSA-8hqx-3wqc-785g","UBUNTU-CVE-2026-104063","openSUSE-SU-2026:12444-1","openSUSE-SU-2026:22254-1"],"status":"published","title":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image Data","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00171,"percentile":0.06539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-10-30T15:15:57Z","modified":"2026-11-11T17:27:07Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.8+dfsg-4","1.5.8+dfsg-5","1.6.2+dfsg-1","1.6.3+dfsg-0.1","1.6.3+dfsg-0.2","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Debian:13","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg-0.2","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Debian:14","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg-0.2","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5+dfsg1-2","1.4.5+dfsg1-4","1.4.5+dfsg1-5","1.4.6+dfsg-1","1.4.6+dfsg-1build1","1.4.6+dfsg-2","1.4.6+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.6+dfsg-4build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.8+dfsg-1","1.4.8+dfsg-1ubuntu1","1.5.5+dfsg-4","1.5.5+dfsg-5","1.5.5+dfsg-5build1","1.5.5+dfsg-5ubuntu1","1.5.5+dfsg-5ubuntu2","1.5.5+dfsg-6","1.5.5+dfsg-6build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.7+dfsg-5","1.5.7+dfsg-5build1","1.5.7+dfsg-5build2","1.5.8+dfsg-1","1.5.8+dfsg-1ubuntu2","1.5.8+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.8+dfsg-4build4","1.5.8+dfsg-4build5","1.5.8+dfsg-4build6","1.6.1-0ubuntu1","1.6.1-0ubuntu2","1.6.1-0ubuntu5","1.6.1-0ubuntu6","1.6.1-0ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5+dfsg-0ubuntu1","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg-0.2build2","1.6.3+dfsg-0.2build3","1.6.3+dfsg-0.2build4","1.6.5+dfsg-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-bp160.1.1"}]}],"bundled":7}],"products":[{"vendor":"scribus","product":"scribus"}],"references":[{"url":"https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4","tags":["patch","fix","report"]},{"url":"https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f","tags":["patch","fix","report"]},{"url":"https://github.com/scribusproject/scribus","tags":["product","package","report"]},{"url":"https://wiki.scribus.net/canvas/1.6.7_Release","tags":["release-notes","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-read-via-pict-planar-image-data","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104063","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8hqx-3wqc-785g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104063.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104063","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-104063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104063","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104067","tags":["web"]},{"url":"https://bugzilla.suse.com/1249440","tags":["report"]},{"url":"https://bugzilla.suse.com/1257664","tags":["report"]},{"url":"https://bugzilla.suse.com/1265939","tags":["report"]},{"url":"https://bugzilla.suse.com/1289041","tags":["report"]},{"url":"https://bugzilla.suse.com/1289042","tags":["report"]},{"url":"https://bugzilla.suse.com/1289043","tags":["report"]},{"url":"https://bugzilla.suse.com/1289044","tags":["report"]},{"url":"https://bugzilla.suse.com/1289045","tags":["report"]},{"url":"https://bugzilla.suse.com/1289046","tags":["report"]},{"url":"https://bugzilla.suse.com/1289047","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-104063","title":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image Data","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T15:15:57.615Z","modified":"2026-11-02T20:37:48.715Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T00:01:30.510858Z"}],"euvd":[{"id":"EUVD-2026-114099","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T15:15:57Z","modified":"2026-11-02T20:37:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T05:08:37.390802Z"}],"ghsa":[{"id":"GHSA-8hqx-3wqc-785g","title":"Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader...","description":"Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T18:32:36Z","modified":"2026-11-02T21:31:44Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T00:02:47.574481Z"}],"nvd":[{"id":"CVE-2026-104063","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T16:17:35.863Z","modified":"2026-11-02T21:17:21.647Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T00:02:40.715424Z"}],"osv":[{"id":"CVE-2026-104063","title":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image Data","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T15:15:57.615Z","modified":"2026-11-11T17:27:07.111191522Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-11T17:46:33.10646Z"},{"id":"DEBIAN-CVE-2026-104063","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T16:17:35.863Z","modified":"2026-11-03T10:00:29.720311576Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"UBUNTU-CVE-2026-104063","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.","status":"published","published":"2026-10-30T16:17:00Z","modified":"2026-11-05T04:42:37Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"openSUSE-SU-2026:12444-1","title":"scribus-1.6.7-1.1 on GA media","description":"These are all security issues fixed in the scribus-1.6.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:12.553703063Z","updated_at":"2026-11-06T18:05:03.243497Z"},{"id":"openSUSE-SU-2026:22254-1","title":"Security update for scribus","description":"This update for scribus fixes the following issues:\n\nChanges in scribus:\n\n- Update to 1.6.7\n  * Fixes CVE-2026-104061 / boo#1289047\n  * Fixes CVE-2026-104062 / boo#1289046\n  * Fixes CVE-2026-104063 / boo#1289045\n  * Fixes CVE-2026-104064 / boo#1289044\n  * Fixes CVE-2026-104065 / boo#1289043\n  * Fixes CVE-2026-104066 / boo#1289042\n  * Fixes CVE-2026-104067 / boo#1289041\n  * [Text Frames / Story Editor] Superscript text: the text\n    outline is offset\n  * [Import / Export] Property changes do not affect the text\n    imported from .odt\n  * [Canvas] Rendering of drop shadows is slow (Fahad)\n  * [General] The application freezes when attempting to import\n    'custom shapes'\n  * [Undo/Redo] Deleting a non existent mark causes crash\n  * [General] Preview mode does not hide guides/margins when\n    editing a master page\n  * [General] The bleed area still shows in Preview mode in\n    Master Page editing mode\n  * [Typography] Text formatting (e.g. italic, bold) is not\n    inherited when resuming typing\n  * [General] Failure to build with poppler 26.07.0\n  * [Graphics / Image Frames] Crash with graphicsmagick exception\n  * [General] Failure to build with poppler 26.06.0\n  * [General] Failure to build with poppler 26.05.0\n  * [Fonts] Font \"Helsinki\" causes crash\n\n- Fix failure to build with poppler 26.05.0 (boo#1265939)\n- Change scribus-doc sub-package to noarch.\n\n- Update to 1.6.6\n  * [Scripter] Add get/setImageRotation to Scripter\n  * [Graphics / Image Frames] Lost image links after collect for\n    output\n  * [General] Failure to build with poppler 26.04.0\n  * [General] Failure to build with poppler 26.03.0\n  * [Import / Export] MS Publisher import needs more\n    development: Image scaling\n  * [Plug-ins] Fix bad escape sequences in Python docstring\n  * [General] Failure to build with poppler 26.02.0\n  * [Plug-ins] Color wheel doesn't move to correct color\n  * [PDF] Scribus crashes due to umlaut composition in file names\n    of embedded PDF documents\n\n- Update to 1.6.5\n  * [General]  NTLM hash leak in Scribus\n  * [User Interface]  Dark Color Schema unusable\n  * [Color Management]  Color picker (eyedropper) does not work\n    (always returns \"black\")\n  * [General]  Layer disappears after editing inline object\n    (layer visibility scrambling)\n  * [General]  Failure to build with poppler 25.10.0\n  * [PDF]  Scribus crashes when exporting pdf via python and the\n    document has a PDF-Push-Button or other PDF-thingy\n  * [Build System]  Won't Compile: 'const_key_value_iterator' does\n    not name a type\n  * [Styles]  The line spacing mode drop down is not correctly\n    displayed for styles with a parent\n  * [Build System]  Fails to build with poppler 25.07\n  * [PDF]  Build failure with podofo 1.0\n  * [Scripter]  Undocumented feature in scribus.ImageExport: transparentBckgnd\n  * [Scripter]  Documentation of function getBoundingBox()\n    missing from HTML docs\n  * [Fonts]  Additional Font Path Settings reset\n  * [General]  Crash when loading legacy file produced with\n    Scribus 1.4.6\n  * [Scripter]  Using unknown/misspelled named parameter in API\n    call causes Scribus crash\n  * [Canvas]  Sometimes all items in a document become invisible\n  * [General]  Failure to build with poppler 25.09.0\n  * [General]  Accept negative values for the rotation in the\n    properties palette\n  * [General]  1.6.4 fails to build with popper 25.06.0\n  * [Fonts]  Font rendering different after PDF export\n  * [Printing]  Print Dialog - Inconsistency between output\n    filename extension and printing language\n  * [Printing]  Print Dialog - Crop marks not present in output\n    when they are the only marks selected\n","status":"published","published":"2026-11-04T19:11:46Z","modified":"2026-11-11T17:23:13.166606451Z","updated_at":"2026-11-11T17:47:15.466074Z"}]}}