Scribus before version 1.6.7 has an integer overflow in the TIFF loader that processes tile dimensions. Crafted TIFF files with excessively large tile width, height, or sample values can cause the loader to allocate a buffer that does not correctly reflect the requested size, leading to a heap overflow. This overflow can corrupt heap memory, potentially resulting in a crash of Scribus or an execution of attacker‑controlled code, depending on the layout of the corrupted memory.

All installations of Scribus older than version 1.6.7 are affected. Only the core Scribus application is impacted; third‑party plug‑ins or distributed binaries that incorporate the same TIFF loader code share the same vulnerability.

The vulnerability carries a CVSS score of 8.5, classifying it as high severity. EPSS data is not available, but the lack of external exploitation reports and absence from the KEV catalog suggest that widespread exploitation is currently unlikely. The attack vector is local: an attacker must supply a user with a malicious TIFF file that the victim will import. If a user opens such a file, the heap can be overwritten, potentially allowing arbitrary code execution or crash. The official CNA recommends patching to Scribus 1.6.7 or later to mitigate the vulnerability.