A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. (CVE-2026-77652)

The Dia diagram editor's WPG import renderer allocates a fixed palette buffer of 256 entries. When processing a WPG_COLORMAP record, the parser reads a start index and number of colors from the file and reads palette data into the buffer without validating that the start index and number of colors fit within the 256-entry buffer. Specifically, the check only ensures the start index is within the WPG record size, not the palette capacity. A malicious WPG file can specify a start index of 256 and 264 colors, causing fread() to write 792 bytes beyond the allocated 768-byte palette buffer. This heap overflow can corrupt adjacent heap metadata, leading to crashes (SIGABRT, malloc corruption) or potentially arbitrary code execution depending on heap layout and exploit conditions. The vulnerability affects all Dia versions containing this code path, confirmed in Dia 0.98+git20260221-1 and upstream master as of 2026-08-21. Exploitation requires user interaction to open a crafted file but no special privileges.

Successful exploitation can cause denial of service via application crashes or, depending on heap layout and exploit primitives, may allow arbitrary code execution. The vulnerability compromises confidentiality, integrity, and availability of the affected system. No elevated privileges are required to trigger the vulnerability, but user interaction is necessary to open a malicious WPG file.

No official patch or fix is currently available for this vulnerability. Users should avoid opening untrusted or suspicious WPG files with Dia until a fix is released. Monitor vendor advisories for updates regarding patches or mitigations. Since this is a client-side vulnerability requiring user interaction, user education on handling untrusted files can reduce risk.