Scribus EUVD-2026-114100

Requires a victim to import an attacker-crafted tiled TIFF file (with large TILEWIDTH, TILELENGTH and sample values) into Scribus before 1.6.7; the overflow is triggered in the TIFF tile-buffer allocation path of scimgdataloader_tiff. No authentication is required (PR:N). Limiting factors: exploitation is local and depends on passive user interaction (UI:P) - the attacker cannot trigger it remotely without the user opening the file - and it only affects Scribus versions prior to 1.6.7; reliable code execution additionally depends on heap layout and is not demonstrated in the available sources.

This is a CWE-190 integer overflow in the Scribus TIFF tile loader (scimgdataloader_tiff) that leads to a heap buffer overflow. The patch commit confirms the mechanism: the original code computed the tile buffer size as 'columns * rows * sizeof(uint32_t)' using unchecked 32-bit values taken directly from attacker-controlled TIFF tile tags, so large TILEWIDTH/TILELENGTH values overflow the multiplication and produce an undersized allocation that is then overrun by TIFFReadTile/_TIFFmemcpy. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.5) is internally consistent with a file-parsing flaw: no privileges needed, but a local vector and passive user interaction (the victim must import a crafted file). This is NOT remotely wormable and NOT a server-side network flaw - it requires social engineering to get a victim to open a malicious TIFF. No CISA KEV listing and no EPSS score were provided, so widespread-exploitation signals are absent; exploitation status is 'no public exploit identified at time of analysis' (the supplied references are the patch commit, the project repo, the 1.6.7 release note, and a VulnCheck advisory - none is verified working exploit code). The vuln.today decision label is 'this_week', consistent with a patched, high-severity client-side memory-corruption bug that is not under active exploitation. Net: a real priority for anyone running Scribus before 1.6.7, but the client-side/file-import requirement and absence of KEV/EPSS/PoC signals place it below emergency urgency. The description claims code execution is possible, but heap-overflow exploitability depends on heap layout and is not demonstrated in the available sources.

An attacker crafts a tiled TIFF with oversized tile width, height and sample values and delivers it to a Scribus user (e.g. as a shared design asset or email attachment). When the victim imports the image into Scribus before 1.6.7, the integer overflow produces an undersized heap buffer that is then overflowed during tile copy, crashing the application or potentially executing attacker code. No public exploit was identified in the provided data; code execution is described as possible but not demonstrated.