Is CVE-2026-104061 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104061?

CVE-2026-104061 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-104061

Description

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.