Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling
Affects Scribus versions before 1.6.7 when a tiled TIFF file is loaded. The fix is in Scribus 1.6.7.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.6.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Scribus, an open-source desktop publishing application, is affected by a flaw in how it loads tiled TIFF image files. A specially crafted image can overflow memory, causing the program to crash or potentially allowing an attacker to run malicious code on the user's computer.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Scribus Scribus
fixed in 1.6.7
References 4
GitHub · scribusproject/scribus
wiki.scribus.net
Questions about CVE-2026-104064
What does this mean?
An integer overflow in the tile buffer size calculation leads to a write outside the allocated memory. This corrupts heap memory, which can crash Scribus or potentially allow worse outcomes.Source: github.com, wiki.scribus.net
Am I affected, and how do I check?
Scribus versions before 1.6.7 are affected, and only when a tiled TIFF is being loaded. To check, compare your installed Scribus version with 1.6.7 and consider whether you open tiled TIFF files.Source: github.com, wiki.scribus.net
What should I do about it?
Upgrade to Scribus 1.6.7, which fixes the TIFF loader heap overflows. No workaround is listed in the facts.Source: github.com, wiki.scribus.net
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data