Bug 2564130 (CVE-2026-104067)
| Summary: | CVE-2026-104067 scribus: scribus: Arbitrary code execution via crafted SVM file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Scribus. This vulnerability can lead to arbitrary code execution or a Denial of Service (DoS) due to an application crash. The StarView Metafile (SVM) import plugin fails to verify that bitmap and transparency mask dimensions match when processing files. An attacker could exploit this issue by convincing a user to open a specially crafted SVM file, triggering out-of-bounds memory reads and writes on the heap.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565845, 2565848, 2565851, 2565853 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-30 15:33:46 UTC
|