CVE-2026-104067 Details
Description
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.
A memory access vulnerability allowing out-of-bounds reads and writes has been identified in Scribus versions prior to 1.6.7. This issue resides within the importsvm plugin, which improperly validates the dimensions of bitmaps and transparency masks. Attackers can exploit this vulnerability by providing a crafted SVM file that contains mismatched mask dimensions, potentially leading to crashes or arbitrary code execution under the user's privileges.
Users are advised to update to Scribus version 1.6.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Scribus | >= 0, < 1.6.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | [email protected] |
| Oct 30, 2026 | New CVE Received | [email protected] |
| Oct 30, 2026 | CVE Modified | CISA-ADP |