The Scribus application, prior to version 1.6.7, contains an out-of-bounds memory access in the importsvm plugin. The plugin fails to confirm that bitmap and transparency mask dimensions match, allowing an attacker to supply a crafted SVM file with mismatched mask dimensions. The resulting heap reads and writes can crash the program or enable code execution while the user is running Scribus.

All installations of Scribus earlier than version 1.6.7 are vulnerable. The issue originates in the importsvm plugin, which is enabled by default in those releases.

The CVSS score of 8.5 reflects a high severity vulnerability. EPSS data are not available, and the flaw is not listed in CISA's KEV catalog. Because the exploit requires a crafted SVM file to be opened by Scribus, the attack vector is likely local via user interaction; however, if an untrusted file can be tricked into opening, an attacker could achieve crash or arbitrary code execution. The vulnerability is therefore a high risk for environments where Scribus opens files from untrusted or external sources.