7.8
HighCVSS 3.1 · from VulnCheck
CVE-2026-104067
Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin
Scribus · Out-of-bounds write · CWE-787AffectedScribus
FixUpdate to 1.6.7 or newer
PublishedOct 30, 15:16 · VulnCheck
ScoredOct 30 · 7.8 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inScribusbefore 1.6.71.6.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known