Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.6.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Scribus, a desktop publishing application, is affected when it imports Micrografx Draw (DRW) files through its plugin. A specially crafted DRW file can trigger a memory write outside an allocated buffer, which could crash the application or allow an attacker to run arbitrary code on the user's system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Scribus Scribus
fixed in 1.6.7
References 4
GitHub · scribusproject/scribus
wiki.scribus.net
Questions about CVE-2026-104065
What does this mean?
A specially crafted DRW file imported through Scribus's Micrografx Draw import filter can make the program read or write memory outside the buffer it allocated. This can cause a crash or potentially worse.Source: wiki.scribus.net
Am I affected, and how do I check?
Scribus versions before 1.6.7 are affected when a DRW file is imported through the Micrografx Draw filter. To check your version, look at the version shown in Scribus's About dialog or run scribus --version.Source: wiki.scribus.net
What should I do about it?
Upgrade Scribus to version 1.6.7 or later, which contains the fix.Source: wiki.scribus.net
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data