Scribus 1.6.7 Released

[MrB]

The Scribus Team is pleased to announce the release of version 1.6.7. This is a bugfix release with the following changes. This release fixes seven security vulnerabilities in Scribus's image loaders and import filters, along with several crashes, a macOS preferences issue, and a range of text, canvas and display bugs. It also keeps Scribus building against the latest poppler releases. All users of 1.6.x are strongly encouraged to upgrade, particularly anyone who opens image or vector files from untrusted sources.

Security
Seven memory-safety vulnerabilities have been fixed in the loaders that read PSD, PICT, TIFF, DRW and SVM files. A specially crafted file in any of these formats could cause Scribus to read or write outside allocated memory when placed in an image frame or imported, leading to a crash or potentially worse. Each loader now validates the dimensions and offsets it reads from the file before using them.

CVE-2026-104061 – PSD: out-of-bounds read from a static array, leading to a heap write
CVE-2026-104062 – PICT: heap overflow in the pixmap loader when the stored bytes-per-line does not match the image width
CVE-2026-104063 – PICT: out-of-bounds read of planar image data
CVE-2026-104064 – TIFF: integer overflow in the tile buffer size calculation, leading to an out-of-bounds write
CVE-2026-104065 – DRW: out-of-bounds scanline access through an unvalidated vertical offset
CVE-2026-104066 – PICT: heap overflow when unpacking 4-bit indexed images
CVE-2026-104067 – SVM: out-of-bounds access when image and mask dimensions differ

Stability
Fixed a crash when an exception was raised by GraphicsMagick while loading an image
Fixed a crash caused by the font "Helsinki"
Fixed a crash when undoing or redoing the deletion of a mark that no longer exists
Fixed Scribus freezing when importing custom shapes

Text & Typography
Character formatting such as bold or italic is now carried over when resuming typing after a formatted run
Superscript text with the Outline effect enabled no longer draws the outline offset from the glyphs
Multiple consecutive soft hyphens can no longer be inserted
Property changes are now applied to text imported from OpenDocument (.odt) files

Canvas & Display
Drop shadows render considerably faster
Scrolling or zooming no longer leaves stale cursor markers on the rulers
Preview mode now hides guides and margins while editing a master page
Preview mode now hides the bleed area while editing a master page

User Interface
The Ctrl++ zoom-in shortcut now works as expected

macOS
Starting Scribus with --prefs <dir> no longer moves the existing Scribus 1.5/1.6 preference files out of the default profile location
Fixed a link failure when building with WANT_GRAPHICSMAGICK where GraphicsMagick is not installed in a default linker path

Build System & Compatibility
Scribus now builds against newer releases of poppler

Thanks
Thanks to everyone who reported bugs, tested fixes and contributed patches for this release, and to Tristan Madani from Talence Security who reported the image loader vulnerabilities responsibly.

Additional Notes
The complete changelog is available here: https://bugs.scribus.net/changelog_page.php?version_id=130

[utnik]

will there be a 1.6.7 for intel based mac computers?

utnik

[MrB]

will there be a 1.6.7 for intel based mac computers?

utnik

Its there now.. ran out of time last night.
NOTE: Its using the latest libraries available - Please see if you see any text layout differences. I can release one with all the old libraries but there could be security issues within them.