CVE-2026-104064: Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling
Published Oct 30, 2026
·Updated
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
Other sources
Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
— MITRE
Affected Software
11 affected components
debian/scribus*
debian/scribus*
debian/scribus*
debian/scribus<=1.5.8+dfsg-4, <=1.6.3+dfsg-0.2, <=1.6.6+dfsg-0.2
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
ubuntu/scribus*
Event History
Oct 30, 2026
CVE Published
via MITRE·03:15 PM
Data Sourced
via MITRE·03:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·04:17 PM
Affected Software