Quick answers
- Is CVE-2026-104066 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104066 being exploited in the wild.
- How severe is CVE-2026-104066?
- High severity, with a CVSS score of 7.8, published 30 October 2026.
- Which products and versions are affected?
- Scribus Project Scribus before 1.6.7.
- Is there a fix for CVE-2026-104066?
- Yes: fixed in Scribus 1.6.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-104066 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-104066?
- Check whether you run Scribus Project Scribus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Scribus 1.6.7
Technical details
A heap buffer overflow exists in the Mac PICT image loader when unpacking 4-bit indexed pixel data, caused by inconsistent width and row data validation. The vulnerability is in the import plugin's image data loader component and can be triggered via a maliciously crafted PICT file with no authentication or user interaction required beyond importing the file. The issue allows out-of-bounds writes leading to crashes or code execution.
Affected products
- Scribus Project Scribus before 1.6.7
Timeline
- 2026-10-30: disclosed