{"id":"CVE-2026-104064","aliases":["DEBIAN-CVE-2026-104064","EUVD-2026-114100","GHSA-pxxc-449x-5899","UBUNTU-CVE-2026-104064","openSUSE-SU-2026:12444-1","openSUSE-SU-2026:22254-1"],"status":"published","title":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00212,"percentile":0.11629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-190"],"published":"2026-10-30T15:15:58Z","modified":"2026-11-11T17:27:06Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.8+dfsg-4","1.5.8+dfsg-5","1.6.2+dfsg-1","1.6.3+dfsg-0.1","1.6.3+dfsg-0.2","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Debian:13","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg-0.2","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Debian:14","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg-0.2","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5+dfsg1-2","1.4.5+dfsg1-4","1.4.5+dfsg1-5","1.4.6+dfsg-1","1.4.6+dfsg-1build1","1.4.6+dfsg-2","1.4.6+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.6+dfsg-4build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.8+dfsg-1","1.4.8+dfsg-1ubuntu1","1.5.5+dfsg-4","1.5.5+dfsg-5","1.5.5+dfsg-5build1","1.5.5+dfsg-5ubuntu1","1.5.5+dfsg-5ubuntu2","1.5.5+dfsg-6","1.5.5+dfsg-6build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.7+dfsg-5","1.5.7+dfsg-5build1","1.5.7+dfsg-5build2","1.5.8+dfsg-1","1.5.8+dfsg-1ubuntu2","1.5.8+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.8+dfsg-4build4","1.5.8+dfsg-4build5","1.5.8+dfsg-4build6","1.6.1-0ubuntu1","1.6.1-0ubuntu2","1.6.1-0ubuntu5","1.6.1-0ubuntu6","1.6.1-0ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5+dfsg-0ubuntu1","1.6.6+dfsg-0.1","1.6.6+dfsg-0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3+dfsg-0.2build2","1.6.3+dfsg-0.2build3","1.6.3+dfsg-0.2build4","1.6.5+dfsg-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"scribus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-bp160.1.1"}]}],"bundled":7}],"products":[{"vendor":"scribus","product":"scribus"}],"references":[{"url":"https://github.com/scribusproject/scribus/commit/b3e2be4e0f4063991c0b3af1c1447218ed33f0cc","tags":["patch","fix","report"]},{"url":"https://github.com/scribusproject/scribus/commit/57ebf70d503eef7124fcfba0e6222ea4d80675d2","tags":["patch","fix","report"]},{"url":"https://github.com/scribusproject/scribus","tags":["product","package","report"]},{"url":"https://wiki.scribus.net/canvas/1.6.7_Release","tags":["release-notes","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-overflow-via-tiff-tile-buffer-handling","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104064","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pxxc-449x-5899"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104064.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104064","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-104064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104064","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104067","tags":["web"]},{"url":"https://bugzilla.suse.com/1249440","tags":["report"]},{"url":"https://bugzilla.suse.com/1257664","tags":["report"]},{"url":"https://bugzilla.suse.com/1265939","tags":["report"]},{"url":"https://bugzilla.suse.com/1289041","tags":["report"]},{"url":"https://bugzilla.suse.com/1289042","tags":["report"]},{"url":"https://bugzilla.suse.com/1289043","tags":["report"]},{"url":"https://bugzilla.suse.com/1289044","tags":["report"]},{"url":"https://bugzilla.suse.com/1289045","tags":["report"]},{"url":"https://bugzilla.suse.com/1289046","tags":["report"]},{"url":"https://bugzilla.suse.com/1289047","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-104064","title":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T15:15:58.358Z","modified":"2026-11-04T22:45:51.728Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-04T23:40:08.898049Z"}],"euvd":[{"id":"EUVD-2026-114100","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T15:15:58Z","modified":"2026-11-04T22:45:51Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-pxxc-449x-5899","title":"Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF...","description":"Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T18:32:36Z","modified":"2026-11-02T21:31:44Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-03T00:02:47.574481Z"}],"nvd":[{"id":"CVE-2026-104064","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T16:17:36.027Z","modified":"2026-11-04T23:17:18.143Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T01:45:13.601219Z"}],"osv":[{"id":"CVE-2026-104064","title":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T15:15:58.358Z","modified":"2026-11-11T17:27:06.672383099Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-11T17:46:38.239173Z"},{"id":"DEBIAN-CVE-2026-104064","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T16:17:36.027Z","modified":"2026-11-05T09:47:35.436957351Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-104064","description":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","status":"published","published":"2026-10-30T16:17:00Z","modified":"2026-11-05T04:42:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"openSUSE-SU-2026:12444-1","title":"scribus-1.6.7-1.1 on GA media","description":"These are all security issues fixed in the scribus-1.6.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:12.553703063Z","updated_at":"2026-11-06T18:05:03.243497Z"},{"id":"openSUSE-SU-2026:22254-1","title":"Security update for scribus","description":"This update for scribus fixes the following issues:\n\nChanges in scribus:\n\n- Update to 1.6.7\n  * Fixes CVE-2026-104061 / boo#1289047\n  * Fixes CVE-2026-104062 / boo#1289046\n  * Fixes CVE-2026-104063 / boo#1289045\n  * Fixes CVE-2026-104064 / boo#1289044\n  * Fixes CVE-2026-104065 / boo#1289043\n  * Fixes CVE-2026-104066 / boo#1289042\n  * Fixes CVE-2026-104067 / boo#1289041\n  * [Text Frames / Story Editor] Superscript text: the text\n    outline is offset\n  * [Import / Export] Property changes do not affect the text\n    imported from .odt\n  * [Canvas] Rendering of drop shadows is slow (Fahad)\n  * [General] The application freezes when attempting to import\n    'custom shapes'\n  * [Undo/Redo] Deleting a non existent mark causes crash\n  * [General] Preview mode does not hide guides/margins when\n    editing a master page\n  * [General] The bleed area still shows in Preview mode in\n    Master Page editing mode\n  * [Typography] Text formatting (e.g. italic, bold) is not\n    inherited when resuming typing\n  * [General] Failure to build with poppler 26.07.0\n  * [Graphics / Image Frames] Crash with graphicsmagick exception\n  * [General] Failure to build with poppler 26.06.0\n  * [General] Failure to build with poppler 26.05.0\n  * [Fonts] Font \"Helsinki\" causes crash\n\n- Fix failure to build with poppler 26.05.0 (boo#1265939)\n- Change scribus-doc sub-package to noarch.\n\n- Update to 1.6.6\n  * [Scripter] Add get/setImageRotation to Scripter\n  * [Graphics / Image Frames] Lost image links after collect for\n    output\n  * [General] Failure to build with poppler 26.04.0\n  * [General] Failure to build with poppler 26.03.0\n  * [Import / Export] MS Publisher import needs more\n    development: Image scaling\n  * [Plug-ins] Fix bad escape sequences in Python docstring\n  * [General] Failure to build with poppler 26.02.0\n  * [Plug-ins] Color wheel doesn't move to correct color\n  * [PDF] Scribus crashes due to umlaut composition in file names\n    of embedded PDF documents\n\n- Update to 1.6.5\n  * [General]  NTLM hash leak in Scribus\n  * [User Interface]  Dark Color Schema unusable\n  * [Color Management]  Color picker (eyedropper) does not work\n    (always returns \"black\")\n  * [General]  Layer disappears after editing inline object\n    (layer visibility scrambling)\n  * [General]  Failure to build with poppler 25.10.0\n  * [PDF]  Scribus crashes when exporting pdf via python and the\n    document has a PDF-Push-Button or other PDF-thingy\n  * [Build System]  Won't Compile: 'const_key_value_iterator' does\n    not name a type\n  * [Styles]  The line spacing mode drop down is not correctly\n    displayed for styles with a parent\n  * [Build System]  Fails to build with poppler 25.07\n  * [PDF]  Build failure with podofo 1.0\n  * [Scripter]  Undocumented feature in scribus.ImageExport: transparentBckgnd\n  * [Scripter]  Documentation of function getBoundingBox()\n    missing from HTML docs\n  * [Fonts]  Additional Font Path Settings reset\n  * [General]  Crash when loading legacy file produced with\n    Scribus 1.4.6\n  * [Scripter]  Using unknown/misspelled named parameter in API\n    call causes Scribus crash\n  * [Canvas]  Sometimes all items in a document become invisible\n  * [General]  Failure to build with poppler 25.09.0\n  * [General]  Accept negative values for the rotation in the\n    properties palette\n  * [General]  1.6.4 fails to build with popper 25.06.0\n  * [Fonts]  Font rendering different after PDF export\n  * [Printing]  Print Dialog - Inconsistency between output\n    filename extension and printing language\n  * [Printing]  Print Dialog - Crop marks not present in output\n    when they are the only marks selected\n","status":"published","published":"2026-11-04T19:11:46Z","modified":"2026-11-11T17:23:13.166606451Z","updated_at":"2026-11-11T17:47:15.466074Z"}]}}