CVE-2026-104067 in Scribus
Summary
by MITRE • 10/30/2026
Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Scribus application prior to version 1.6.7 is susceptible to an out-of-bounds memory access vulnerability within its importsvm plugin, specifically arising from a failure to validate that bitmap dimensions align with transparency mask dimensions. This flaw represents a classic instance of improper input validation where the software processes external data without ensuring internal consistency checks are performed on critical structural parameters. When a user opens or imports a specially crafted SVM file containing mismatched width and height values for its image layer versus its alpha channel, the application proceeds to allocate memory buffers based on one set of dimensions while attempting to access them using another. This discrepancy leads directly to heap-based buffer over-reads and potentially over-writes as the parsing logic iterates through pixel data without bounds checking against the actual allocated size.
From a technical perspective, this vulnerability is categorized under CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write depending on whether the exploit primarily reads sensitive memory contents or attempts to overwrite adjacent heap metadata and objects. The lack of dimension verification allows an attacker to craft a malicious document that forces the application to access memory regions outside the intended buffer boundaries. In many modern operating systems, such as Windows with Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), simple crashes are often mitigated by these protections; however, sophisticated exploitation techniques can still leverage heap spraying or specific gadget chains within the Scribus binary to achieve arbitrary code execution. The vulnerability effectively allows an attacker who tricks a user into opening a malicious file to execute code with the same privileges as the current user, which is particularly dangerous if that user operates with administrative rights or has access to sensitive documents stored in local directories accessible by the application.
The operational impact of this flaw extends beyond simple denial of service through application crashes. While stability issues are immediate and frequent for users encountering malformed files, the primary security concern lies in remote code execution capabilities. An attacker can distribute a malicious SVM file via email attachments, shared network drives, or compromised websites hosting vector graphics resources. Upon opening such a file within Scribus, the out-of-bounds access can be manipulated to leak heap contents containing sensitive information from other applications running on the same system due to memory sharing in some contexts, or more critically, to hijack control flow by overwriting function pointers or exception handling structures. This aligns with ATT&CK technique T1203 Exploitation for Client Execution, where adversaries use vulnerable software components as a vector to gain initial access and execute malicious payloads on the target system without requiring direct network exploitation against a server service.
Mitigation strategies primarily involve upgrading Scribus to version 1.6.7 or later, where this validation logic has been corrected to ensure that bitmap dimensions strictly match transparency mask dimensions before processing begins. Until an upgrade is feasible, users should exercise extreme caution when opening SVM files from untrusted sources and consider using sandboxed environments for document review if possible. Additionally, implementing strict file type filtering at the network perimeter or endpoint detection level can help block known malicious variants of this exploit vector. Security teams should also ensure that operating system-level mitigations such as DEP, ASLR, and Control Flow Guard are enabled to reduce the likelihood of successful code execution even if the memory corruption occurs. Regular patch management remains the most effective defense against these types of application-layer vulnerabilities in desktop publishing software.