CVE-2026-77658: Stack-based Buffer Overflow in GNOME Dia

The vulnerability exists in the bus_load() function of objects/network/bus.c in GNOME Dia, where the number of bus handles is read from the "bus_handles" attribute without validating an upper bound. When a bus handle is moved, bus_handle_moved() allocates two temporary arrays on the stack using g_alloca() based on this unvalidated count. If the count is excessively large (e.g., 262144 or more), this causes stack overflow exceeding typical thread stack limits (around 8 MB on Linux), resulting in a crash (SIGSEGV) and potential stack frame or return address corruption. An attacker can embed a malicious Bus object in a .dia file to trigger this condition when the file is opened and a bus handle is moved. The same unsafe allocation pattern is present in objects/Misc/tree.c, indicating a similar vulnerability via Tree objects. The issue affects Dia 0.98.0 and earlier versions containing this code and is confirmed on upstream master as of August 21, 2026. Red Hat's advisory states no currently supported Red Hat products are affected.

Successful exploitation can cause a stack overflow leading to application crash (denial of service) and potential memory corruption, which may allow an attacker to execute arbitrary code or bypass security protections. The vulnerability impacts confidentiality, integrity, and availability of the affected system running Dia when opening and manipulating maliciously crafted .dia files.

No official patch or fix is currently confirmed. Users should avoid opening untrusted or suspicious .dia project files, especially those containing Network Bus or Tree objects with excessive bus handle counts. Monitor vendor advisories for updates and patches. Red Hat has confirmed no currently supported Red Hat products are affected by this vulnerability.