Live › vulnerability › CVE-2026-104065
Scribus before 1.6.7 has an out-of-bounds write in its Micrografx Draw (DRW) import plugin, where an unvalidated y offset selects image scanlines. A crafted DRW file imported by a user writes decoded bitmap data outside the heap image buffer, causing crashes or possibly code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams running Scribus before 1.6.7 that import Micrografx Draw (.drw) files, especially files received from outside the organization. Installs that never import DRW files are not exposed through this path.
No product ranges from the sources yet.
scribus --version or the About dialog; versions below 1.6.7 are affected.1.6.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-104065")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.