Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin

Advisories

Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin

Severity: high
Date: 10/30/2026
Affecting: Scribus >= 0, < 1.6.7
CVE: CVE-2026-104067
CWE: CWE-787 Out-of-bounds Write
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: Patch Commit
https://github.com/scribusproject/scribus
https://wiki.scribus.net/canvas/1.6.7_Release
Credit: Tristan Madani, Jean Ghali
Description: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo