Scribus EUVD-2026-114103

Requires a victim to open or import an attacker-supplied SVM (StarView Metafile) file using Scribus's built-in importsvm plugin on a version before 1.6.7; the crafted file must carry a bitmap whose dimensions differ from its transparency mask, which the pre-patch getImageDataFromStyle code fails to validate. Limiting factors that reduce real-world risk: the attack vector is local (the file must reach and be opened on the target machine), it requires user interaction (UI:P - the user must actively open/import the file), there is no network-reachable trigger, and only versions prior to 1.6.7 are affected. No non-default configuration is needed - SVM import is standard plugin functionality.

This is a moderate-priority, file-parsing memory-corruption flaw rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) is internally consistent with the description: exploitation is local and file-driven - a victim must open or import a crafted SVM file in Scribus (UI:P / passive user interaction) - not a remotely reachable network service. The high VC/VI/VA:H impact is justified by the source diff, which shows unvalidated bitmap dimensions (imageWidth/imageHeight) flowing into image handling, matching CWE-787 (out-of-bounds write) with potential for code execution as the user. The vuln.today decision label is 'this_week', consistent with a patched, user-interaction-gated client bug. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so there is no signal of active or widespread exploitation; no public exploit code is referenced either (the VulnCheck entry is a vendor-style advisory, not a working PoC). Net: a genuine high-severity bug worth patching promptly, but the local/user-interaction requirement and absence of KEV/EPSS/PoC signals place it below internet-facing unauthenticated RCEs in real-world urgency. Note PR:N technically marks it unauthenticated, but exploitation realistically depends on social-engineering a user into opening a malicious file.

An attacker crafts a malicious SVM (StarView Metafile) document with a bitmap whose dimensions do not match its transparency mask and delivers it to a victim (e.g., via email or a shared design asset). When the victim opens or imports the file in a vulnerable Scribus build, the importsvm plugin performs out-of-bounds heap reads and writes, causing a crash or code execution in the user's context. No public exploit code is identified at time of analysis; the trigger mechanism is corroborated by the vendor fix commit.