{"id":"CVE-2026-104065","kind":"vulnerability","aliases":["CVE-2026-104065"],"related":[],"title":"Scribus: crafted DRW file write outside heap buffer, possible code execution","description":"Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.","summary":"Scribus before 1.6.7 has an out-of-bounds write in its Micrografx Draw (DRW) import plugin, where an unvalidated y offset selects image scanlines. A crafted DRW file imported by a user writes decoded bitmap data outside the heap image buffer, causing crashes or possibly code execution.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-publishing","linux","macos","package","scribus","windows"],"not_affected_if":["no-drw-import","scribus-1.6.7-or-later"],"how_to_check":"- Check the installed Scribus version with `scribus --version` or the About dialog; versions below `1.6.7` are affected.\n- Note whether users import DRW files from untrusted sources.","fix":"- Scribus: move to `1.6.7` or later.","status":"open","published_at":"2026-10-30T16:17:36+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:31:53+00:00","updated_at":"2026-10-30T16:31:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T16:31:53Z","model":"claude-haiku-5-5","output":{"fix":"- Scribus: move to `1.6.7` or later.","reach":"local","title":"Scribus: crafted DRW file write outside heap buffer, possible code execution","impact":"high","summary":"Scribus before 1.6.7 has an out-of-bounds write in its Micrografx Draw (DRW) import plugin, where an unvalidated y offset selects image scanlines. A crafted DRW file imported by a user writes decoded bitmap data outside the heap image buffer, causing crashes or possibly code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["scribus","desktop-publishing","linux","windows","macos"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Crafted file could crash Scribus or run code as the user.","analyst_note":"Confirm the fixed version and any upstream advisory text beyond the NVD description; sources given state only the 1.6.7 threshold.","how_to_check":"- Check the installed Scribus version with `scribus --version` or the About dialog; versions below `1.6.7` are affected.\n- Note whether users import DRW files from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["scribus-1.6.7-or-later","no-drw-import"],"who_is_affected":"Teams running Scribus before 1.6.7 that import Micrografx Draw (.drw) files, especially files received from outside the organization. Installs that never import DRW files are not exposed through this path.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4152,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104065':14A,17A '-2026':13A,16A '1.6.7':28B,76C 'attack':101C 'bitmap':61B,115C 'bound':34B,82C 'buffer':8A,67B,121C 'caus':68B,122C 'code':10A,72B,125C 'contain':77C 'craft':2A,52B,103C 'crash':69B,123C 'cve':12A,15A 'data':62B,116C 'decod':60B,114C 'desktop':19B 'desktop-publish':18B 'draw':39B,89C 'drw':3A,40B,53B,105C 'execut':11A,73B,126C 'file':4A,54B,106C 'heap':7A,65B,119C 'imag':49B,66B,99C,120C 'import':41B,55B,109C 'importdrw':87C 'linux':21B 'maco':22B 'micrografx':38B,88C 'offset':47B,96C 'out-of-bound':31B,79C 'outsid':6A,63B,117C 'packag':23B 'plugin':42B,90C 'possibl':9A,71B 'publish':20B 'scanlin':50B,100C 'scribus':1A,24B,26B,74C 'select':48B,98C 'unvalid':45B,94C 'use':92C 'user':58B,112C 'vulner':84C 'window':25B 'write':5A,35B,59B,83C,113C 'y':46B,95C","nicknames":[],"mitigations":[],"who_affected":"Teams running Scribus before 1.6.7 that import Micrografx Draw (.drw) files, especially files received from outside the organization. Installs that never import DRW files are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104065","severity":null,"published_at":"2026-10-30T16:17:36+00:00","modified_at":"2026-10-30T16:17:36+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}