Scribus CVE-2026-104065

Exploitation requires a victim to import an attacker-crafted Micrografx Draw (.DRW) file through Scribus's built-in importdrw plugin; the malicious file supplies a y offset that is used without bounds validation to select an image scanline, causing decoded bitmap data to be written past the heap image buffer. The DRW import plugin ships with default Scribus installations, so no non-default configuration is needed, but the attack is strictly local and file-driven (AV:L): it cannot be triggered remotely or without the user opening/importing the file (UI:P). The principal limiting factor is this required user interaction - the victim must be socially engineered into importing the crafted file - which, together with the absence of KEV/EPSS/PoC signals, constrains realistic exploitation to targeted scenarios. Versions before 1.6.7 are affected; updating to 1.6.7 is the vendor fix.

This is a genuine but conditional memory-corruption issue, not an over-rated high-CVSS artifact. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) correctly frames it as a client-side, file-parsing bug: no privileges are required, but a local file must be processed and user interaction (importing the file) is mandatory, so there is no remote or automatable mass-exploitation path. The source diff confirms the mechanism - an unvalidated scanline index (yoff + y) used in QImage::scanLine() leading to a heap out-of-bounds write (CWE-787) - which supports the 'crashes or code execution' claim, though actual code execution is asserted by the description, not demonstrated. The vuln.today priority is 'this_week' and a vendor patch (1.6.7) exists, so this should be scheduled promptly rather than deferred. No EPSS score and no KEV listing are present in the input, and no PoC/exploit reference is provided, so there is no evidence of active or widespread exploitation; the realistic risk is targeted social-engineering (tricking a user into importing a malicious DRW file) rather than opportunistic remote attack.

An attacker crafts a malicious Micrografx Draw (.DRW) file with a y offset that drives the decoder past the allocated image buffer and delivers it to a Scribus user (e.g., via email or a download). When the victim imports the file through the importdrw plugin, decoded bitmap data is written outside the heap image buffer, crashing Scribus or potentially allowing code execution in the user's context. Exploitation is local and requires user interaction (AV:L/UI:P); no public exploit was identified at time of analysis.