Vulnerability Description
Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/scribusproject/scribus
- https://github.com/scribusproject/scribus/commit/b3e2be4e0f4063991c0b3af1c144721
- https://wiki.scribus.net/canvas/1.6.7_Release
- https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-overflow-via-tiff
FAQ
What is CVE-2026-104064?
CVE-2026-104064 is a vulnerability with a CVSS score of 7.8 (HIGH). Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supp...
How severe is CVE-2026-104064?
CVE-2026-104064 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-104064?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.