CVE-2026-104067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104067", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-01T18:02:50.082Z", "datePublished": "2026-10-30T15:16:00.500Z", "dateUpdated": "2026-11-02T20:37:51.372Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T20:37:51.372Z"}, "datePublic": "2026-09-15T00:00:00.000Z", "title": "Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import Plugin", "descriptions": [{"lang": "en", "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "Scribus", "product": "Scribus", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.6.7", "status": "affected", "versionType": "custom"}, {"version": "1.7.0", "lessThan": "1.7.4", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/scribusproject/scribus/commit/c6aed467680d04e8ae8e0588579b095acdae40ef", "tags": ["patch"], "name": "Patch Commit (1.6.x)"}, {"url": "https://github.com/scribusproject/scribus/commit/5a8f67c4207d6f729f23e4370b5846dadc81e8b4", "tags": ["patch"], "name": "Patch Commit (1.7.x)"}, {"url": "https://github.com/scribusproject/scribus", "tags": ["product"]}, {"url": "https://wiki.scribus.net/canvas/1.6.7_Release", "tags": ["release-notes"]}, {"name": "VulnCheck Advisory: Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-memory-access-via-svm-import-plugin"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}, {"lang": "en", "value": "Jean Ghali", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:32:56.657952Z", "id": "CVE-2026-104067", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:33:08.066Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T15:32:56.657952Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:33:03.511Z"}}], "cna": {"title": "Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import Plugin", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani"}, {"lang": "en", "type": "remediation developer", "value": "Jean Ghali"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Scribus", "product": "Scribus", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.7", "versionType": "custom"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-15T00:00:00.000Z", "references": [{"url": "https://github.com/scribusproject/scribus/commit/c6aed467680d04e8ae8e0588579b095acdae40ef", "name": "Patch Commit (1.6.x)", "tags": ["patch"]}, {"url": "https://github.com/scribusproject/scribus/commit/5a8f67c4207d6f729f23e4370b5846dadc81e8b4", "name": "Patch Commit (1.7.x)", "tags": ["patch"]}, {"url": "https://github.com/scribusproject/scribus", "tags": ["product"]}, {"url": "https://wiki.scribus.net/canvas/1.6.7_Release", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-memory-access-via-svm-import-plugin", "name": "VulnCheck Advisory: Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T20:37:51.372Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104067", "state": "PUBLISHED", "dateUpdated": "2026-11-02T20:37:51.372Z", "dateReserved": "2026-10-01T18:02:50.082Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T15:16:00.500Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Scribus", "vendor": "Scribus", "versions": [{"lessThan": "1.6.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "1.7.4", "status": "affected", "version": "1.7.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user."}], "id": "CVE-2026-104067", "lastModified": "2026-11-02T21:17:22.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104067", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:32:56.657952Z", "version": "2.0.3"}}]}, "published": "2026-10-30T16:17:36.500", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/scribusproject/scribus"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/scribusproject/scribus/commit/5a8f67c4207d6f729f23e4370b5846dadc81e8b4"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/scribusproject/scribus/commit/c6aed467680d04e8ae8e0588579b095acdae40ef"}, {"source": "disclosure@vulncheck.com", "url": "https://wiki.scribus.net/canvas/1.6.7_Release"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-memory-access-via-svm-import-plugin"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "scribus: scribus: Arbitrary code execution via crafted SVM file", "id": "2564130", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564130"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.", "A flaw was found in Scribus. This vulnerability can lead to arbitrary code execution or a Denial of Service (DoS) due to an application crash. The StarView Metafile (SVM) import plugin fails to verify that bitmap and transparency mask dimensions match when processing files. An attacker could exploit this issue by convincing a user to open a specially crafted SVM file, triggering out-of-bounds memory reads and writes on the heap."], "mitigation": {"lang": "en:us", "value": "Upgrade to Scribus 1.6.7 or 1.7.4; avoid opening untrusted SVM files."}, "name": "CVE-2026-104067", "public_date": "2026-10-30T15:16:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104067\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104067\nhttps://github.com/scribusproject/scribus\nhttps://github.com/scribusproject/scribus/commit/c6aed467680d04e8ae8e0588579b095acdae40ef\nhttps://wiki.scribus.net/canvas/1.6.7_Release\nhttps://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-memory-access-via-svm-import-plugin"], "statement": "This vulnerability is rated as Important severity because successful exploitation can allow arbitrary code execution with the permissions of the logged-in user, though it requires explicit user interaction rather than enabling remote automated execution. In Red Hat environments, Scribus is not included in core Red Hat Enterprise Linux releases, significantly limiting exposure across enterprise server installations. The threat is primarily restricted to desktop environments where an operator manually imports or opens untrusted graphic files.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Scribus", "source": "cna", "vendor": "Scribus"}, "product": "scribus", "vendor": "scribus"}], "created": "2026-10-30T16:15:14.973370+00:00", "updated": "2026-11-02T23:45:20.068001+00:00", "vendors": ["scribus", "scribus$PRODUCT$scribus"]}