CVE-2026-77652: Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
A flaw was found in Dia's WPG (WordPerfect Graphics) import plugin. When parsing a WPG COLORMAP record, the colormap start index and entry count taken from the file are not validated against the fixed 256-entry palette buffer. A crafted WPG file can cause a heap-based buffer overflow in plug-ins/wpg/wpg-import.c, leading to memory corruption, application crash, and potentially arbitrary code execution if a victim opens the malicious file in Dia. Upstream GitLab issue #580 was closed without a fix.
Other sources
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.
In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with:
ren->pPal = gnew0(WPGColorRGB, 256);
When handling a WPGCOLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:
bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f));
The only bounds-related check is if (i16 >= 0 && i16 <= iSize), where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256.
A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution.
Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim.
Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).
— MITRE
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the flaw?
The attacker must provide a crafted WPG file and cause a victim to open it in Dia. The vulnerability is rated as requiring user interaction, and no attacker privileges are required.
Who is exposed to this issue?
Dia users who open untrusted or attacker-controlled WPG files are exposed. Successful exploitation can corrupt memory, crash the application, or potentially execute arbitrary code in the context of the user running Dia.
Is an upstream fix available?
The available information states that upstream GitLab issue #580 was closed without a fix. No fixed Dia version is identified in the provided data.