CVE-2026-77658— Dia 项目文件句柄计数验证缺陷导致栈缓冲区溢出漏洞
一分钟漏洞结论
影响对象
GNOME Dia
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Dia 图形编辑器处理来自 Dia XML 项目文件的“总线”（Network Bus）对象时，存在一个基于栈的缓冲区溢出漏洞。 在文件 中， 函数使用 从文件属性 读取总线句柄的数量，但未对其上限进行验证： 随后，当移动总线句柄时， 函数会在栈上分配两个临时数组： 由于 的值完全由攻击者通过项目文件控制，当该值足够大（例如 262144 或更高）时， 将消耗超出默认线程栈限制（在 Linux 上通常为 8 MB）的栈空间，从而导致栈溢出、SIGSEGV 信号错误，并可能引发栈帧或返回地址损坏。 攻击者可以在恶
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-77658 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files
来源: CVE Program / CVE List V5
Vulnerability Description
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files.
In objects/network/bus.c, bus_load() reads the number of bus handles from the file attribute "bus_handles" using attribute_num_data() without validating an upper bound:
bus->num_handles = attribute_num_data(attr);
When a bus handle is subsequently moved, bus_handle_moved() allocates two temporary arrays on the stack:
parallel = (real *)g_alloca(num_handles * sizeof(real));
perp = (real *)g_alloca(num_handles * sizeof(real));
Because num_handles is fully attacker-controlled via the project file, sufficiently large values (for example 262144 or higher) cause g_alloca() to consume more stack space than the default thread stack limit (typically 8 MB on Linux), resulting in stack overflow, SIGSEGV, and potential stack frame / return-address corruption.
An attacker can embed a Bus object with an excessive bus_handles count in a malicious .dia file. Exploitation requires the victim to open the file in Dia (file dialog, command line, or file association) and trigger handle manipulation (moving a bus handle), which exercises the vulnerable code path.
The identical g_alloca pattern is present in objects/Misc/tree.c (copied from bus.c) and is likely vulnerable to the same class of attack via Tree objects.
Affected versions: Dia 0.98.0 and earlier versions containing this code; issue confirmed on upstream master as of 2026-08-21.
Upstream report: https://gitlab.gnome.org/GNOME/dia/-/issues/581
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-77658 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-77658 的情报信息
请登录查看更多情报信息。
CVE-2026-77658 其他参考 (4)
-
-
2520890 – (CVE-2026-77658) CVE-2026-77658 dia: dia: stack buffer overflow in Bus object via unvalidated handle count in project files issue-tracking x_refsource_REDHAT
IV. Related Vulnerabilities
V. Comments for CVE-2026-77658
暂无评论