{"id":"CVE-2026-77652","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-77652","summary":"A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.\n\nIn plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette…","details":"A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.\n\nIn plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with:\n\n    ren->pPal = g_new0(WPGColorRGB, 256);\n\nWhen handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:\n\n    bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f));\n\nThe only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256.\n\nA malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution.\n\nExploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim.\n\nAffected component: WPG parser (plug-ins/wpg/wpg-import.c).\nAffected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).","published":"2026-08-26T20:18:02.160","modified":"2026-08-28T15:44:39.323","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-77652"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520884"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/dia/-/blob/master/plug-ins/wpg/wpg-import.c"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/dia/-/issues/580"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/dia/-/issues/580"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-28T15:44:39.323"}}