Out-of-Bounds Write Vulnerability in Scribus Micrografx Draw Plugin

CVE-2026-104065

What is CVE-2026-104065?

Scribus versions prior to 1.6.7 are vulnerable to an out-of-bounds write due to an issue in the importdrw Micrografx Draw plugin. This vulnerability occurs when an unvalidated y offset is used to select image scanlines, allowing attackers to craft a malicious DRW file. If a user imports this file, it can lead to writing decoded bitmap data outside the intended heap image buffer, potentially resulting in application crashes or arbitrary code execution.

References