Description
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.
In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with:
ren->pPal = g_new0(WPGColorRGB, 256);
When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:
bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f));
The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256.
A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution.
Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim.
Affected component: WPG parser (plug-ins/wpg/wpg-import.c).
Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
Published: n/a
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap‑based buffer overflow exists in Dia’s WPG file importer. The parser allocates a fixed 256‑entry palette but accepts an index and length that can exceed this capacity, overwriting adjacent heap metadata. Depending on heap layout and available primitives, an attacker may crash Dia with a SIGABRT or elevate the overwrite to arbitrary code execution, thereby compromising confidentiality, integrity, and availability of the affected system.

Affected Systems

The vulnerability affects the Dia diagram editor from the GNOME project. All Dia releases that include the current wpg‑import.c code path—twelve months of development versions tested from 0.98 and the master branch as of August 2026—are susceptible. Users of older or patched distributions that have incorporated a bounds check are not impacted.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, and the EPSS score is not available, though the lack of a KEV listing implies no mass exploitation has been reported. Exploitation requires the victim to open a crafted WPG file, which can be delivered via the file dialog, command line, or file association. No elevated privileges are needed to supply the malicious file, making local or remote file‑based delivery straightforward for an attacker.

Generated by OpenCVE AI on August 25, 2026 at 14:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Dia to the latest release that includes bounds checking for the WPG palette index and size fields.
  • If an update is not yet available, disable or remove the WPG import plugin or change file associations so that WPG files are not automatically opened by Dia.
  • When opening unknown WPG files, run them in a sandboxed environment or use an antivirus scanner to detect malicious payloads before launching the file.

Generated by OpenCVE AI on August 25, 2026 at 14:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Gnome
Gnome dia
Vendors & Products Gnome
Gnome dia

Tue, 25 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with: bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
Title dia: dia: heap buffer overflow in WPG colormap parser via out-of-bounds palette index
Weaknesses CWE-122
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Subscriptions

Gnome Dia
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-21T00:00:00Z

Links: CVE-2026-77652 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T14:30:19Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow