CVE-2026-77652

HighCVSS 7.8

Published: 26/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

In the Dia diagram editor, there is a heap-based buffer overflow vulnerability in the WPG file format importer. The WPG import renderer allocates a fixed palette of 256 entries. When handling a WPG_COLORMAP record, the parser reads a start index and number of colors without validating bounds. A malicious WPG file can cause an out-of-bounds write, leading to a crash or potentially arbitrary code execution.

Risk Assessment

A user opening a malicious WPG file may experience application crashes or, worse, an attacker could achieve remote code execution on the victim's machine.

Recommendation

Upgrade Dia to the latest patched version and avoid opening untrusted WPG files.

Other vulnerabilities in Dia

CVE-2026-77658High
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. The bus_load() function reads the number of bus handles from the "bus_handles" attribute without validating an upper bound, and bus_handle_moved() allocates stack arrays based on this count. Excessive values (e.g., 262144) cause stack overflow, SIGSEGV, and potential stack frame corruption.

Original NVD description (English source)

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with: bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).