Is CVE-2026-104066 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104066?

CVE-2026-104066 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-104066

Description

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.