DEBIAN-CVE-2026-104067: High severity debian/scribus vulnerability

Published Oct 30, 2026

Updated

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.

Affected Software

3 affected components

debian/scribus*

Event History

Oct 30, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

The attacker must provide a crafted SVM file whose bitmap and transparency mask dimensions do not match, and a user must import or otherwise process that file with the affected importsvm plugin. Exploitation can cause a crash or potentially execute code as the user running Scribus.

Which Scribus versions are affected?

Scribus versions before 1.6.7 are affected, as are 1.7.x versions before 1.7.4. The provided data does not identify specific Debian package versions.

Who is exposed in practice?

Users who handle untrusted SVM files in affected Scribus versions are exposed. The vulnerability is local in the supplied severity data and requires user interaction, so an attacker needs to persuade a user to open or import a malicious file.

DEBIAN-CVE-2026-104067: High severity debian/scribus vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

Which Scribus versions are affected?

Who is exposed in practice?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

Which Scribus versions are affected?

Who is exposed in practice?