Integer Overflow Vulnerability in Scribus TIFF Loader
CVE-2026-104064

8.5HIGH

Key Information:

Vendor

Scribus

Status
Scribus
Vendor
CVE Published:
30 October 2026

What is CVE-2026-104064?

Scribus, an open-source desktop publishing software, is affected by an integer overflow vulnerability in its TIFF loader component. This vulnerability allows attackers to exploit crafted TIFF images by supplying excessively large tile dimensions, leading to a heap overflow condition. As a result, malicious users could potentially crash the application or execute arbitrary code. It is crucial for users to upgrade to Scribus version 1.6.7 or later to mitigate this risk.

Affected Version(s)

Scribus 0 < 1.6.7

References

https://github.com/scribusproject/scribus/commit/b3e2be4e...
patch
https://github.com/scribusproject/scribus
product
https://wiki.scribus.net/canvas/1.6.7_Release
release-notes

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani
Jean Ghali
.