CVE-2026-77652: Heap-based Buffer Overflow in GNOME Dia

The vulnerability exists in the WPG import renderer of Dia (plug-ins/wpg/wpg-import.c), where a fixed palette of 256 entries is allocated. When processing a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data into the allocated buffer without proper validation that i16 and i16 + iNum16 do not exceed the palette capacity of 256 entries. A malicious WPG file can specify i16=256 and iNum16=264, causing fread() to write 792 bytes beyond the allocated 768-byte buffer, overflowing into adjacent heap metadata. This can cause Dia to crash due to malloc corruption or, depending on heap layout and exploit conditions, allow arbitrary code execution. Exploitation requires user interaction to open a crafted WPG file. The vulnerability was confirmed in Dia 0.98+git20260221-1 and is present in upstream master as of 2026-08-21.

The vulnerability can lead to denial of service through application crashes (SIGABRT or malloc corruption errors) and potentially arbitrary code execution if an attacker can control heap layout and exploit primitives. The impact includes full compromise of the affected application process, potentially affecting confidentiality, integrity, and availability. No special privileges are required for exploitation, but user interaction is necessary to open a malicious WPG file.

Red Hat's advisory states that this vulnerability does not affect any currently supported Red Hat products. No official patch or fix is currently documented in the advisory. Users of Dia should monitor the upstream project for patches addressing this issue. Until a fix is available, avoid opening untrusted WPG files with Dia to mitigate risk.