CVE-2026-104065 in Scribus
Summary
by MITRE • 10/30/2026
Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Scribus versions prior to 1.6.7 represents a critical memory corruption flaw located within the importdrw plugin responsible for handling Micrografx Draw files. This specific component processes DRW file formats, which are vector graphics documents that may contain embedded bitmap data or references to raster images. The core technical deficiency lies in the lack of rigorous input validation regarding coordinate parameters during the image decoding process. Specifically, when parsing a maliciously crafted DRW file, the application fails to verify whether the y-offset value provided by the attacker is within acceptable bounds relative to the allocated memory buffer for the image scanlines. This oversight allows an adversary to manipulate internal pointers or array indices that dictate where decoded pixel data should be written in memory.
From a technical perspective, this flaw constitutes an out-of-bounds write vulnerability, which aligns with CWE-787: Out-of-Bounds Write. The mechanism involves the application allocating a heap buffer intended to hold image scanlines based on expected dimensions derived from the file header or metadata. However, because the y-offset is not validated against the actual allocated size of this buffer, an attacker can supply a value that exceeds the upper limit of the buffer's address space. When the importdrw plugin proceeds to decode and write bitmap data using this unvalidated offset, it writes bytes beyond the boundaries of the designated heap region. This memory corruption does not merely result in reading invalid data but actively overwrites adjacent memory structures on the heap, potentially corrupting metadata such as allocation headers or function pointers stored nearby.
The operational impact of this vulnerability is severe due to its potential for remote code execution and denial of service. If an attacker successfully crafts a DRW file that triggers this out-of-bounds write with precise control over the overwritten memory contents, they can achieve arbitrary code execution on the victim's system by hijacking control flow or executing shellcode placed in adjacent writable memory regions. Even if exploitation for code execution is mitigated by modern operating system protections such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), the vulnerability remains a significant threat because it can reliably cause application crashes through segmentation faults or access violations. This leads to a denial of service condition, disrupting workflow for users who rely on Scribus for desktop publishing tasks involving imported graphics.
This incident maps directly to several entries in the MITRE ATT&CK framework, particularly T1203: Exploitation for Client Execution and techniques associated with memory corruption exploitation such as Heap Spraying or Arbitrary Write primitives used to bypass security mitigations. The vulnerability highlights a common class of defects found in legacy graphics processing libraries where performance optimizations sometimes come at the cost of robust input validation. To mitigate this risk, organizations must ensure that all instances of Scribus are upgraded to version 1.6.7 or later, which includes patches for the importdrw plugin's memory handling logic. Additionally, users should exercise caution when opening DRW files from untrusted sources and consider implementing application whitelisting or sandboxing solutions to limit the potential impact if a malicious file is inadvertently processed before an update can be applied.