A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. (CVE-2026-77658)

The vulnerability (CVE-2026-77658) in Dia occurs in the bus_load() function where the number of bus handles is read from the "bus_handles" attribute without upper bound validation. Later, bus_handle_moved() allocates two arrays on the stack sized by this number using g_alloca(). An attacker can craft a .dia file with a large bus_handles value (e.g., 262144 or higher) causing g_alloca() to allocate more stack space than the thread stack limit, resulting in stack overflow, SIGSEGV, and potential stack frame or return address corruption. The vulnerability requires the victim to open the malicious file and move a bus handle to trigger the overflow. A similar pattern exists in tree.c, suggesting related vulnerabilities may exist in Tree objects. The issue is confirmed on upstream master as of 2026-08-21 and affects multiple specific versions of Dia up to 0.98.0.

Successful exploitation can cause a stack overflow leading to application crash (SIGSEGV) and potential corruption of stack frames or return addresses, which may allow an attacker to execute arbitrary code or cause denial of service. The attack requires user interaction to open a crafted .dia file and manipulate bus handles. The vulnerability has a CVSS 3.1 score of 7.8, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted .dia files and refrain from manipulating bus handles in files from untrusted sources. Monitor the upstream Dia project and vendor advisories for official patches or updates addressing this vulnerability.