Scribus: Heap out-of-bounds write in PSD loader (CVE-2026-104061)
Scribus versions prior to 1.6.7 contain a heap out-of-bounds write vulnerability in the PSD loader that allows attackers to trigger memory corruption via a malicious file.
CVE search metadata
CVE search record: CVE-2026-104061. Severity: high. CVSS: 7.8. KEV: no. Product: Scribus (< 1.6.7). Brief: Scribus: Heap out-of-bounds write in PSD loader (CVE-2026-104061). Brief link: https://feed.craftedsignal.io/briefs/2026-10-scribus-heap-oob/
CVE search record: CVE-2026-104062. Severity: high. CVSS: 7.8. KEV: no. Product: Scribus (< 1.6.7). Brief: Scribus: Heap out-of-bounds write in PSD loader (CVE-2026-104061). Brief link: https://feed.craftedsignal.io/briefs/2026-10-scribus-heap-oob/
Triage facts
Revision 1- Applicability
- Scribus (< 1.6.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 30, 17:36 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for Scribus (< 1.6.7) Oct 30, 17:36 via nvd
Scribus versions before 1.6.7 are susceptible to a heap out-of-bounds write vulnerability within the 'scimgdataloader_psd' component. The vulnerability arises from the application using unchecked values sourced from PSD files as lookup array indexes. An attacker can exploit this by convincing a victim to import or open a crafted PSD file, leading to application crashes or the potential for arbitrary code execution within the context of the user running the application.
Impact
Successful exploitation allows an attacker to corrupt heap memory, which can lead to service disruption via crashes or arbitrary code execution with the privileges of the user running the Scribus application.
Recommendation
- Update all Scribus installations to version 1.6.7 or later immediately to remediate the vulnerability in the PSD file parser.
- Implement file integrity monitoring or application allowlisting if applicable to restrict the origin of PSD files imported into the organization's desktop environment.
Immediate actions
Patch Scribus to 1.6.7 or later on all user workstations
Patch all Scribus instances to version 1.6.7 or later.
Threat Hunt
Identify endpoints with Scribus versions < 1.6.7 installed
Data: Installed software inventory (e.g., EDR/Asset management tools)
Identify endpoints where Scribus is installed and scan for recently opened or imported files with the .pict extension.
Data: File audit logs (e.g., Windows USN Journal or Linux fsnotify/auditd), Application MRU (Most Recently Used) files
Mitigations
Upgrade Scribus to 1.6.7
CVE-2026-104061
Upgrade Scribus to 1.6.7.
CVE-2026-104062