DEBIAN-CVE-2026-104064: Integer Overflow

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

Affected Software

3 affected components

debian/scribus*

Event History

Oct 30, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Scribus who import TIFF files are exposed, particularly when opening tiled TIFF images from untrusted or unknown sources. The issue affects versions before 1.6.7 and 1.7.x versions before 1.7.4.

What does an attacker need to exploit it?

An attacker needs to provide a crafted tiled TIFF containing large tile width, height, and sample values, and persuade a user to import it into Scribus. No attacker privileges are required, but user interaction is required.

What can happen if exploitation succeeds?

The crafted dimensions can cause an integer overflow followed by a heap overflow in the TIFF loader. This may crash Scribus or allow code execution in the context of the user running Scribus.

What should be done if patching cannot happen immediately?

Avoid importing tiled TIFF files from untrusted sources until Scribus is updated. Treat TIFF assets with unusually large tile dimensions or sample values as untrusted.

DEBIAN-CVE-2026-104064: Integer Overflow

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can happen if exploitation succeeds?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can happen if exploitation succeeds?

What should be done if patching cannot happen immediately?