Is CVE-2026-104062 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104062?

CVE-2026-104062 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-104062

Description

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.