UBUNTU-CVE-2026-104064: Integer Overflow
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Scribus who import TIFF files are exposed, particularly where they may open TIFFs received from untrusted or external sources. The vulnerable code is the TIFF loader used for tiled TIFF images.
What must an attacker do to exploit it?
An attacker needs to provide a crafted tiled TIFF containing large tile width, height, and sample values, and persuade a user to import it into Scribus. No attacker privileges are required, but user interaction is required.
Which Scribus versions are affected?
Scribus versions before 1.6.7 are affected, along with 1.7.x versions before 1.7.4.
What is the impact of successful exploitation?
The crafted tile dimensions can cause an integer overflow followed by heap memory corruption. This may crash Scribus or allow code execution with the privileges of the user running Scribus.