CVE-2026-104066

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104066", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-01T18:02:50.082Z", "datePublished": "2026-10-30T15:15:59.772Z", "dateUpdated": "2026-11-02T20:37:50.733Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T20:37:50.733Z"}, "datePublic": "2026-09-14T00:00:00.000Z", "title": "Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking", "descriptions": [{"lang": "en", "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "Scribus", "product": "Scribus", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.6.7", "status": "affected", "versionType": "custom"}, {"version": "1.7.0", "lessThan": "1.7.4", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4", "tags": ["patch"], "name": "Patch Commit (1.6.x)"}, {"url": "https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f", "tags": ["patch"], "name": "Patch Commit (1.7.x)"}, {"url": "https://github.com/scribusproject/scribus", "tags": ["product"]}, {"url": "https://wiki.scribus.net/canvas/1.6.7_Release", "tags": ["release-notes"]}, {"name": "VulnCheck Advisory: Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}, {"lang": "en", "value": "Jean Ghali", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T18:25:47.985640Z", "id": "CVE-2026-104066", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:37:00.577Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104066", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T18:25:47.985640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:25:48.812Z"}}], "cna": {"title": "Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani"}, {"lang": "en", "type": "remediation developer", "value": "Jean Ghali"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Scribus", "product": "Scribus", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.7", "versionType": "custom"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-14T00:00:00.000Z", "references": [{"url": "https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4", "name": "Patch Commit (1.6.x)", "tags": ["patch"]}, {"url": "https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f", "name": "Patch Commit (1.7.x)", "tags": ["patch"]}, {"url": "https://github.com/scribusproject/scribus", "tags": ["product"]}, {"url": "https://wiki.scribus.net/canvas/1.6.7_Release", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking", "name": "VulnCheck Advisory: Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T20:37:50.733Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104066", "state": "PUBLISHED", "dateUpdated": "2026-11-02T20:37:50.733Z", "dateReserved": "2026-10-01T18:02:50.082Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T15:15:59.772Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Scribus", "vendor": "Scribus", "versions": [{"lessThan": "1.6.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "1.7.4", "status": "affected", "version": "1.7.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution."}], "id": "CVE-2026-104066", "lastModified": "2026-11-02T21:17:22.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104066", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T18:25:47.985640Z", "version": "2.0.3"}}]}, "published": "2026-10-30T16:17:36.340", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/scribusproject/scribus"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4"}, {"source": "disclosure@vulncheck.com", "url": "https://wiki.scribus.net/canvas/1.6.7_Release"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "scribus: scribus: Arbitrary code execution via crafted PICT file", "id": "2564134", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564134"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.", "A flaw was found in Scribus. By tricking a user into importing or placing a specially crafted Macintosh Picture (PICT) image file with inconsistent dimension data, an attacker can trigger a heap-based buffer overflow during pixel unpacking. This flaw can allow an attacker to achieve arbitrary code execution or cause the application to crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Avoid opening, placing, or importing PICT image files from untrusted sources until an updated scribus package (>= 1.6.7 or >= 1.7.4) is installed."}, "name": "CVE-2026-104066", "public_date": "2026-10-30T15:15:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104066\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104066\nhttps://github.com/scribusproject/scribus\nhttps://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4\nhttps://wiki.scribus.net/canvas/1.6.7_Release\nhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking"], "statement": "A heap buffer overflow in Scribus's Mac PICT image loader and import plugin allows arbitrary code execution or crashes when a crafted PICT file with inconsistent width and row data is placed or imported. Fixed in Scribus 1.6.7 and 1.7.4 (commits d667b3b, 544a179).", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Scribus", "source": "cna", "vendor": "Scribus"}, "product": "scribus", "vendor": "scribus"}], "created": "2026-10-30T16:45:15.109381+00:00", "updated": "2026-11-02T23:15:14.328989+00:00", "vendors": ["scribus", "scribus$PRODUCT$scribus"]}