{"id":"UBUNTU-CVE-2026-77652","details":"A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with:     ren-\u003epPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:     bRet &= (iNum16 == (int)fread(&ren-\u003epPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is `if (i16 \u003e= 0 && i16 \u003c= iSize)`, where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).","modified":"2026-09-02T19:36:34.286159216Z","published":"2026-08-26T20:18:00Z","upstream":["CVE-2026-77652"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-77652"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-77652"},{"type":"REPORT","url":"https://gitlab.gnome.org/GNOME/dia/-/issues/580"}],"affected":[{"package":{"name":"dia","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/dia?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"dia","binary_version":"0.97.3-1"},{"binary_name":"dia-common","binary_version":"0.97.3-1"},{"binary_name":"dia-gnome","binary_version":"0.97.3-1"},{"binary_name":"dia-libs","binary_version":"0.97.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/dia?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20160930-6","0.97.3+git20160930-7","0.97.3+git20160930-8"],"ecosystem_specific":{"binaries":[{"binary_name":"dia","binary_version":"0.97.3+git20160930-8"},{"binary_version":"0.97.3+git20160930-8","binary_name":"dia-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/dia?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20160930-8.1","0.97.3+git20160930-8.2","0.97.3+git20160930-9"],"ecosystem_specific":{"binaries":[{"binary_version":"0.97.3+git20160930-9","binary_name":"dia"},{"binary_version":"0.97.3+git20160930-9","binary_name":"dia-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/dia?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20160930-9","0.97.3+git20160930-9build1"],"ecosystem_specific":{"binaries":[{"binary_name":"dia","binary_version":"0.97.3+git20160930-9build1"},{"binary_name":"dia-common","binary_version":"0.97.3+git20160930-9build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/dia?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20220525-5build1","0.97.3+git20220525-5build2","0.97.3+git20220525-5build3","0.98+git20240130-1","0.98+git20240130-1build2","0.98+git20240130-1build3","0.98+git20240130-1build4"],"ecosystem_specific":{"binaries":[{"binary_name":"dia","binary_version":"0.98+git20240130-1build4"},{"binary_version":"0.98+git20240130-1build4","binary_name":"dia-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"}},{"package":{"name":"dia","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/dia?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98+git20250902-0ubuntu1","0.98+git20250902-0ubuntu2","0.98+git20260221-1"],"ecosystem_specific":{"binaries":[{"binary_name":"dia","binary_version":"0.98+git20260221-1"},{"binary_version":"0.98+git20260221-1","binary_name":"dia-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}