The vulnerability is an out-of-bounds write in Scribus's importdrw Micrografx Draw plugin. An attacker can craft a .drw file that contains an unvalidated y offset, causing decoded bitmap data to be written outside the heap image buffer. This overflow can trigger a crash or present the opportunity for arbitrary code execution when the file is imported.

Scribus versions prior to 1.6.7 are affected, including 1.6.6 and earlier releases. Any system running those versions can be compromised if a user opens a malicious Micrografx Draw file.

The CVSS score of 8.5 reflects a high severity risk, though the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed active exploitation as of the data provided. The likely attack vector requires a user to open a crafted .drw file, making it a local, user‑mediated attack that could lead to remote code execution if the application runs with elevated privileges.