Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77652— Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index

Quick assessment

Affected
GNOME Dia
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GNOME Dia是GNOME基金会开源的一个图表绘制工具。 GNOME Dia 0.98+git20260221-1及之前版本存在缓冲区错误漏洞，该漏洞源于WPG文件格式导入器在处理WPG_COLORMAP记录时未正确验证起始索引和颜色数量，导致基于堆的缓冲区溢出，攻击者可能利用恶意WPG文件导致崩溃或执行任意代码。

CVSS 7.8 · High EPSS 0.21% · P11

Affected Version Matrix 1

VendorProduct Version RangeStatus
GNOME Dia ≤ 0.98+git20260221-1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77652

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
Source: CVE Program / CVE List V5
Vulnerability Description
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with: bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
GNOME Dia 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GNOME Dia是GNOME基金会开源的一个图表绘制工具。 GNOME Dia 0.98+git20260221-1及之前版本存在缓冲区错误漏洞，该漏洞源于WPG文件格式导入器在处理WPG_COLORMAP记录时未正确验证起始索引和颜色数量，导致基于堆的缓冲区溢出，攻击者可能利用恶意WPG文件导致崩溃或执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
GNOME Dia 0 ~ 0.98+git20260221-1 -

II. Public POCs for CVE-2026-77652

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77652

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77652 (2)

Other References for CVE-2026-77652 (2)

Same Patch Batch · GNOME · 2026-08-26 · 3 CVEs total

CVE-2026-77658 7.8 HIGH Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project file
CVE-2026-79902 5.5 MEDIUM Gimp: stack vla size underflow denial of service in seattle

IV. Related Vulnerabilities

Same product: Dia
Same vendor: GNOME
Same weakness: CWE-122

V. Comments for CVE-2026-77652

No comments yet

Leave a comment