REDHAT-BUG-2520890: High severity Dia vulnerability

Published Aug 21, 2026

Updated

A flaw was found in Dia's Network Bus object loader. When opening a crafted Dia project (.dia) file, the bushandles attribute supplies numhandles without validation. Later, when a bus handle is moved, bushandlemoved() allocates two arrays on the stack using galloca() sized by numhandles, which can exhaust the thread stack and cause memory corruption, application crash, or potentially arbitrary code execution. The same galloca pattern exists in objects/Misc/tree.c.

Affected Software

1 affected component

Dia

Event History

Aug 21, 2026

Data Sourced

via Red Hat·04:33 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Dia users who open crafted .dia project files are exposed. The vulnerable path is reached when a Network Bus object's handle is later moved.

What does an attacker need to provide or trigger?

An attacker needs to supply a crafted Dia project file whose bus_handles attribute contains an unvalidated num_handles value. Moving a bus handle then causes stack allocations sized from that value.

Is the Network Bus loader the only relevant code location?

No. The same g_alloca allocation pattern is also present in objects/Misc/tree.c, although the provided information does not specify whether it is reachable through the same file content or workflow.

REDHAT-BUG-2520890: High severity Dia vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to provide or trigger?

Is the Network Bus loader the only relevant code location?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to provide or trigger?

Is the Network Bus loader the only relevant code location?