Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77652— Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index

Quick assessment

Affected
GNOME Dia
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述翻译： Dia 图形编辑器在处理 WPG 文件格式导入时存在一个基于堆的缓冲区溢出漏洞。 在 中，WPG 导入渲染器分配了一个固定大小的调色板： 当处理 记录时，解析器会从文件中读取起始索引（ ）和颜色数量（ ），并通过以下代码读取调色板数据： 唯一的边界相关检查是 ，其中 是 WPG 记录的大小——而不是调色板的容量。没有验证 是否小于 256，也没有验证 是否不超过 256。 一个恶意的 WPG 文件可以提供 和 。这会导致 从 开始写入 792 字节（264 个颜色 × 3 字节/个），而调色板缓冲区

CVSS 7.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
GNOME Dia ≤ 0.98+git20260221-1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77652

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
Source: CVE Program / CVE List V5
Vulnerability Description
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with: bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GNOME Dia 0 ~ 0.98+git20260221-1 -

II. Public POCs for CVE-2026-77652

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77652

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77652 (1)

Other References for CVE-2026-77652 (2)

Other References for CVE-2026-77652 (1)

Same Patch Batch · GNOME · 2026-08-26 · 3 CVEs total

CVE-2026-77658 7.8 HIGH Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project file
CVE-2026-79902 5.5 MEDIUM Gimp: stack vla size underflow denial of service in seattle

IV. Related Vulnerabilities

Same product: Dia
Same vendor: GNOME
Same weakness: CWE-122

V. Comments for CVE-2026-77652

No comments yet

Leave a comment