Bug 2564129 (CVE-2026-104062)
| Summary: | CVE-2026-104062 scribus: scribus: Arbitrary code execution via crafted PICT image file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Scribus. This flaw allows an attacker to achieve arbitrary code execution or cause a denial of service (DoS) by convincing a user to open or import a specially crafted PICT image file. The issue occurs due to improper boundary checks in the PICT image loader and import plugin, causing heap memory corruption when processing manipulated image line dimensions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565822, 2565832, 2565833, 2565838 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-30 15:32:33 UTC
|