CVE-2026-104065: Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import

Q: Which installations are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The listed software entries include Ubuntu and Debian Scribus packages.

Q: What does an attacker need to do to exploit this issue?

An attacker must provide a crafted Micrografx Draw (DRW) file and convince a user to import it. Exploitation occurs through the importdrw plugin during file import.

Q: Are users exposed without interacting with a file?

The available data indicates user interaction is required: a crafted DRW file must be imported. The attack vector is local and the CVSS vector specifies UI:R.

Q: What is the impact of successful exploitation?

The malformed file can cause decoded bitmap data to be written outside the heap image buffer. This can result in application crashes or code execution, with high confidentiality, integrity, and availability impact.

Q: What should be done if the installation cannot be upgraded immediately?

Do not import untrusted or unsolicited Micrografx Draw (DRW) files until Scribus is updated. The provided data does not identify another mitigation.

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.

Other sources

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.

— MITRE

Affected Software

11 affected components

debian/scribus*

debian/scribus<=1.5.8+dfsg-4, <=1.6.3+dfsg-0.2, <=1.6.6+dfsg-0.2

ubuntu/scribus*

Event History

Oct 30, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

Affected Software

Frequently Asked Questions

Which installations are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The listed software entries include Ubuntu and Debian Scribus packages.

What does an attacker need to do to exploit this issue?

An attacker must provide a crafted Micrografx Draw (DRW) file and convince a user to import it. Exploitation occurs through the importdrw plugin during file import.

Are users exposed without interacting with a file?

The available data indicates user interaction is required: a crafted DRW file must be imported. The attack vector is local and the CVSS vector specifies UI:R.

What is the impact of successful exploitation?

The malformed file can cause decoded bitmap data to be written outside the heap image buffer. This can result in application crashes or code execution, with high confidentiality, integrity, and availability impact.

What should be done if the installation cannot be upgraded immediately?

Do not import untrusted or unsolicited Micrografx Draw (DRW) files until Scribus is updated. The provided data does not identify another mitigation.

CVE-2026-104065: Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import

Other sources

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to do to exploit this issue?

Are users exposed without interacting with a file?

What is the impact of successful exploitation?

What should be done if the installation cannot be upgraded immediately?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to do to exploit this issue?

Are users exposed without interacting with a file?

What is the impact of successful exploitation?

What should be done if the installation cannot be upgraded immediately?