{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/scribus--1.6.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:scribus:scribus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-104061"},{"cvss":7.8,"id":"CVE-2026-104062"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Scribus (\u003c 1.6.7)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","desktop-application"],"_cs_type":"advisory","_cs_vendors":["Scribus"],"content_html":"\u003cp\u003eScribus versions before 1.6.7 are susceptible to a heap out-of-bounds write vulnerability within the 'scimgdataloader_psd' component. The vulnerability arises from the application using unchecked values sourced from PSD files as lookup array indexes. An attacker can exploit this by convincing a victim to import or open a crafted PSD file, leading to application crashes or the potential for arbitrary code execution within the context of the user running the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to corrupt heap memory, which can lead to service disruption via crashes or arbitrary code execution with the privileges of the user running the Scribus application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all Scribus installations to version 1.6.7 or later immediately to remediate the vulnerability in the PSD file parser.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring or application allowlisting if applicable to restrict the origin of PSD files imported into the organization's desktop environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T17:36:37Z","date_published":"2026-10-30T17:36:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-scribus-heap-oob/","summary":"Scribus versions prior to 1.6.7 contain a heap out-of-bounds write vulnerability in the PSD loader that allows attackers to trigger memory corruption via a malicious file.","title":"Scribus: Heap out-of-bounds write in PSD loader (CVE-2026-104061)","url":"https://feed.craftedsignal.io/briefs/2026-10-scribus-heap-oob/"}],"language":"en","title":"CraftedSignal Threat Feed - Scribus (\u003c 1.6.7)","version":"https://jsonfeed.org/version/1.1"}