CVE-2026-77652 Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
Heap buffer overflow in Dia's WPG parser allows arbitrary code execution or crash when a user opens a malicious WPG file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-77652?
CVE-2026-77652 is a high-severity memory corruption vulnerability in GNOME Dia, published on 26 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.
In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with:
ren->pPal = g_new0(WPGColorRGB, 256);
When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:
bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f));
The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256.
A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution.
Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim.
Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
Weakness: CWE-122
Which versions are affected by CVE-2026-77652?
How do I fix CVE-2026-77652?
No fix has been published for CVE-2026-77652 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-77652 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77652 exists.
Sources
Also known as DEBIAN-CVE-2026-77652, GHSA-w4q3-279c-xvrv, UBUNTU-CVE-2026-77652.