{"id":"DEBIAN-CVE-2026-77652","details":"A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.  In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with:      ren-\u003epPal = g_new0(WPGColorRGB, 256);  When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:      bRet &= (iNum16 == (int)fread(&ren-\u003epPal[i16], sizeof(WPGColorRGB), iNum16, f));  The only bounds-related check is `if (i16 \u003e= 0 && i16 \u003c= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256.  A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution.  Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim.  Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).","modified":"2026-09-14T17:03:34.228607990Z","published":"2026-08-26T20:18:02.160Z","upstream":["CVE-2026-77652"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-77652"}],"affected":[{"package":{"name":"dia","ecosystem":"Debian:12","purl":"pkg:deb/debian/dia?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20220525-5","0.98+git20240130-1","0.98+git20240528-1","0.98+git20240814-1","0.98+git20250126-1","0.98+git20250126-2","0.98+git20250827-1","0.98+git20250827-2","0.98+git20260221-1","0.98+git20260221-2","0.98+git20260221-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Debian:13","purl":"pkg:deb/debian/dia?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98+git20250126-2","0.98+git20250827-1","0.98+git20250827-2","0.98+git20260221-1","0.98+git20260221-2","0.98+git20260221-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Debian:14","purl":"pkg:deb/debian/dia?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98+git20250126-2","0.98+git20250827-1","0.98+git20250827-2","0.98+git20260221-1","0.98+git20260221-2","0.98+git20260221-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77652.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}