Out-of-Bounds Memory Access Vulnerability in Scribus by The Scribus Project

CVE-2026-104067

What is CVE-2026-104067?

Scribus, prior to version 1.6.7, is susceptible to an out-of-bounds memory access vulnerability within the SVM import plugin. This flaw occurs when the dimensions of the bitmap and transparency mask do not align as expected. Malicious actors can exploit this vulnerability by delivering a specially crafted SVM file that triggers heap reads and writes, potentially leading to crashes or unexpected code execution on the user’s system. Users are advised to update to the latest version to mitigate risks associated with this vulnerability.

References