Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Scribus
  • Scribus

No data.

No data.

References
Link Providers
https://github.com/scribusproject/scribus cve-icon cve-icon
https://github.com/scribusproject/scribus/commit/69f52b53c78542b0a5d377fa0b058fb2773799dc cve-icon cve-icon
https://github.com/scribusproject/scribus/commit/f69b7056eb1a5758a5ebcf218c77b6d84fca97e2 cve-icon cve-icon
https://wiki.scribus.net/canvas/1.6.7_Release cve-icon cve-icon
https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-micrografx-draw-import cve-icon cve-icon
History

Mon, 02 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution. Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.
Title Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via Micrografx Draw Import
References

Fri, 30 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Scribus
Scribus scribus
Vendors & Products Scribus
Scribus scribus

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.
Title Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-30T15:15:59.072Z

Updated: 2026-11-02T20:37:50.053Z

Reserved: 2026-10-01T18:02:50.082Z

Link: CVE-2026-104065

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T16:17:36.180

Modified: 2026-11-02T21:17:21.943

Link: CVE-2026-104065

cve-icon Redhat

No data.