DEBIAN-CVE-2026-77652
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with: bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
DEBIAN-CVE-2026-77652
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-77652
dia
Source reference: /affected/0/package/name
- Affected versions
- 0.97.3+git20220525-5
Source reference:
/affected/0/versions0.98+git20240130-1Source reference:
/affected/0/versions0.98+git20240528-1Source reference:
/affected/0/versions0.98+git20240814-1Source reference:
/affected/0/versions0.98+git20250126-1Source reference:
/affected/0/versions0.98+git20250126-2Source reference:
/affected/0/versions0.98+git20250827-1Source reference:
/affected/0/versions0.98+git20250827-2Source reference:
/affected/0/versions0.98+git20260221-1Source reference:
/affected/0/versions0.98+git20260221-2Source reference:
/affected/0/versions0.98+git20260221-3Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
dia
Source reference: /affected/1/package/name
- Affected versions
- 0.98+git20250126-2
Source reference:
/affected/1/versions0.98+git20250827-1Source reference:
/affected/1/versions0.98+git20250827-2Source reference:
/affected/1/versions0.98+git20260221-1Source reference:
/affected/1/versions0.98+git20260221-2Source reference:
/affected/1/versions0.98+git20260221-3Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
dia
Source reference: /affected/2/package/name
- Affected versions
- 0.98+git20250126-2
Source reference:
/affected/2/versions0.98+git20250827-1Source reference:
/affected/2/versions0.98+git20250827-2Source reference:
/affected/2/versions0.98+git20260221-1Source reference:
/affected/2/versions0.98+git20260221-2Source reference:
/affected/2/versions0.98+git20260221-3Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "dia",
"purl": "pkg:deb/debian/dia?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.97.3+git20220525-5",
"0.98+git20240130-1",
"0.98+git20240528-1",
"0.98+git20240814-1",
"0.98+git20250126-1",
"0.98+git20250126-2",
"0.98+git20250827-1",
"0.98+git20250827-2",
"0.98+git20260221-1",
"0.98+git20260221-2",
"0.98+git20260221-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77652.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "dia",
"purl": "pkg:deb/debian/dia?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.98+git20250126-2",
"0.98+git20250827-1",
"0.98+git20250827-2",
"0.98+git20260221-1",
"0.98+git20260221-2",
"0.98+git20260221-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77652.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "dia",
"purl": "pkg:deb/debian/dia?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.98+git20250126-2",
"0.98+git20250827-1",
"0.98+git20250827-2",
"0.98+git20260221-1",
"0.98+git20260221-2",
"0.98+git20260221-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77652.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58346 · Revision 1
- Added to Heist Feed
- Publisher date