Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Scribus
  • Scribus

No data.

No data.

References
Link Providers
https://github.com/scribusproject/scribus cve-icon cve-icon
https://github.com/scribusproject/scribus/commit/57ebf70d503eef7124fcfba0e6222ea4d80675d2 cve-icon cve-icon
https://github.com/scribusproject/scribus/commit/b3e2be4e0f4063991c0b3af1c1447218ed33f0cc cve-icon cve-icon
https://wiki.scribus.net/canvas/1.6.7_Release cve-icon cve-icon
https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-overflow-via-tiff-tile-buffer-handling cve-icon cve-icon
History

Mon, 02 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code. Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
Title Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling
References

Fri, 30 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Scribus
Scribus scribus
Vendors & Products Scribus
Scribus scribus

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
Title Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling
Weaknesses CWE-190
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-30T15:15:58.358Z

Updated: 2026-11-02T20:37:49.377Z

Reserved: 2026-10-01T18:02:50.082Z

Link: CVE-2026-104064

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T16:17:36.027

Modified: 2026-11-02T21:17:21.797

Link: CVE-2026-104064

cve-icon Redhat

No data.