cve-2026-104064

HIGH CVSS 8.5 gcve_enriched
Description

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

Timeline
Published
2026-10-30 15:15 UTC
Last Modified
2026-11-04
CVSS Details
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
Affected Products
  • Scribus Scribus
Weaknesses (CWE)
CWE-190
SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3
Exploitation
none
Automatable
no
Technical Impact
total
Decision timestamp
2026-11-04T22:45:40.893191Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T22:45:40.893191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T22:45:51.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Scribus",
          "vendor": "Scribus",
          "versions": [
            {
              "lessThan": "1.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.7.4",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jean Ghali"
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T20:37:49.377Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit (1.6.x)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/scribusproject/scribus/commit/b3e2be4e0f4063991c0b3af1c1447218ed33f0cc"
        },
        {
          "name": "Patch Commit (1.7.x)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/scribusproject/scribus/commit/57ebf70d503eef7124fcfba0e6222ea4d80675d2"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/scribusproject/scribus"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://wiki.scribus.net/canvas/1.6.7_Release"
        },
        {
          "name": "VulnCheck Advisory: Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-overflow-via-tiff-tile-buffer-handling"
        }
      ],
      "title": "Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "CVE-2026-104064"
        }
      ],
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-104064",
    "datePublished": "2026-10-30T15:15:58.358Z",
    "dateReserved": "2026-10-01T18:02:50.082Z",
    "dateUpdated": "2026-11-04T22:45:51.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-104064",
      "date": "2026-11-04",
      "epss": "0.00212",
      "percentile": "0.11608"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-104064\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-10-30T16:17:36.027\",\"lastModified\":\"2026-11-02T21:17:21.797\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"Scribus\",\"product\":\"Scribus\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.6.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.7.0\",\"lessThan\":\"1.7.4\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://github.com/scribusproject/scribus\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/scribusproject/scribus/commit/57ebf70d503eef7124fcfba0e6222ea4d80675d2\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/scribusproject/scribus/commit/b3e2be4e0f4063991c0b3af1c1447218ed33f0cc\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://wiki.scribus.net/canvas/1.6.7_Release\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-overflow-via-tiff-tile-buffer-handling\",\"source\":\"disclosure@vulncheck.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-11-03T16:55:29+00:00",
      "cve": "CVE-2026-104064",
      "id": "CVE-2026-104064",
      "initial_release_date": "2026-10-30T15:15:58.358000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "scribus: Scribus: Arbitrary code execution via crafted TIFF tile dimensions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104064.json",
      "version": "3"
    }
  },
  "x_gcve": [
    {
      "extensions": {
        "bcp-05-x-01": {
          "ai_annotations": [
            {
              "ai_level": "generated",
              "description": "VLAI severity classification was generated by Vulnerability-Lookup's /vlai/severity-classification API endpoint based on vulnerability description text.",
              "field_name": "x_gcve.extensions.vlai-severity-enrichment",
              "models": [
                {
                  "gna_source": 1,
                  "identifier": "vlai-severity-classification",
                  "name": "VLAI Severity",
                  "provider": "CIRCL",
                  "version": "fc530b2263ef5a89ae4c75ffcbf6b4d878d44b94"
                }
              ],
              "review_status": "none",
              "scope": "field",
              "tags": [
                "ai-computer-assisted:assistance-level=\"ai-generated\"",
                "ai-computer-assisted:review-level=\"unreviewed\""
              ]
            }
          ]
        },
        "vlai-severity-enrichment": {
          "confidence": 0.9348236322402954,
          "generated_at": "2026-11-04T23:20:14+00:00",
          "severity": "High",
          "vulnerability_id": "CVE-2026-104064"
        }
      }
    }
  ]
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
GCVE AI Severity
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON