Cpe:2.3:a:scribus:scribus:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ascribusscribus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:36:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgScribus: Heap out-of-bounds write in PSD loader (CVE-2026-104061)https://feed.craftedsignal.io/briefs/2026-10-scribus-heap-oob/Fri, 30 Oct 2026 17:36:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-scribus-heap-oob/Scribus versions prior to 1.6.7 contain a heap out-of-bounds write vulnerability in the PSD loader that allows attackers to trigger memory corruption via a malicious file.Scribus versions before 1.6.7 are susceptible to a heap out-of-bounds write vulnerability within the 'scimgdataloader_psd' component. The vulnerability arises from the application using unchecked values sourced from PSD files as lookup array indexes. An attacker can exploit this by convincing a victim to import or open a crafted PSD file, leading to application crashes or the potential for arbitrary code execution within the context of the user running the application.

Impact

Successful exploitation allows an attacker to corrupt heap memory, which can lead to service disruption via crashes or arbitrary code execution with the privileges of the user running the Scribus application.

Recommendation

  • Update all Scribus installations to version 1.6.7 or later immediately to remediate the vulnerability in the PSD file parser.
  • Implement file integrity monitoring or application allowlisting if applicable to restrict the origin of PSD files imported into the organization's desktop environment.
]]>highadvisoryvulnerabilityremote-code-executiondesktop-application