CVE-2026-77652: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-77652 is a heap-based buffer overflow vulnerability in the WPG (WordPerfect Graphics) file format importer of the GNOME Dia diagram editor. The flaw resides in plug-ins/wpg/wpg-import.c and allows a local attacker to trigger heap memory corruption by convincing a user to open a crafted WPG file. All Dia versions up to and including 0.98+git20260221-1 are confirmed affected, with the issue present on upstream master as of 2026-08-21. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds write (CWE-122: Heap-based Buffer Overflow) in the WPG_COLORMAP record handler. The renderer allocates a fixed 256-entry palette (g_new0(WPGColorRGB, 256) = 768 bytes), but the only bounds check — if (i16 >= 0 && i16 <= iSize) — validates the start index against the WPG record size rather than the palette capacity. There is no check that i16 < 256 or that i16 + iNum16 <= 256. A malicious WPG file supplying i16=256 and iNum16=264 causes fread() to write 792 bytes starting at &pPal[256], overflowing 24 bytes into adjacent heap metadata. Exploitation requires user interaction — the victim must open the crafted file via Dia's file dialog, command line, or file association — but no special privileges are needed (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can crash Dia with a SIGABRT or malloc corruption error due to heap metadata corruption. Depending on heap layout and available exploit primitives, an attacker may achieve arbitrary code execution with the privileges of the user running Dia, resulting in high confidentiality, integrity, and availability impact. Red Hat Product Security has determined this vulnerability does not affect any currently supported Red Hat product, though the upstream GNOME Dia codebase remains vulnerable (Red Hat CVE, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The upstream GitLab issue (#580) was closed without a fix, meaning no official patch is available. The attack requires user interaction (opening a crafted WPG file) and has a local attack vector, which reduces the likelihood of mass exploitation. No CISA KEV catalog entry or threat actor attribution has been identified for this CVE (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious WPG file: Create a WPG file containing a WPG_COLORMAP record with a start index (i16) of 256 and a color count (iNum16) of 264. This causes fread() to write 792 bytes starting beyond the 768-byte palette buffer.
2. Deliver the file to the victim: Send the crafted WPG file to the target via email attachment, file share, download link, or any other social engineering vector. No special privileges are required on the attacker's side.
3. Trigger file opening: Convince the victim to open the file using Dia — via the file dialog, double-clicking a file association, or passing it as a command-line argument (e.g., dia malicious.wpg).
4. Heap overflow occurs: The WPG importer reads the attacker-controlled palette indices without bounds validation, causing fread() to write past the allocated heap buffer into adjacent heap metadata.
5. Achieve crash or code execution: Depending on heap layout, the overflow either crashes Dia (SIGABRT / malloc corruption) or, with further heap-shaping techniques, enables arbitrary code execution with the privileges of the victim user (GitHub Advisory, Red Hat CVE).

• Process: Dia process terminating abnormally with SIGABRT or producing malloc(): corrupted top size / heap corruption error messages in stderr or system logs.
• Logs: System journal entries (e.g., journalctl) showing Dia crash with signal 6 (SIGABRT) or glibc heap corruption output immediately after opening a WPG file.
• File System: Presence of unexpected or externally sourced .wpg files in user download directories, temporary folders, or email attachment staging areas.
• Core Dumps: Core dump files generated by Dia (e.g., core, core.dia) in the working directory or configured core dump location, potentially containing heap corruption artifacts.

No official patch has been released; the upstream GitLab issue (#580) was closed without a fix. Until a patch is available, users should avoid opening WPG files from untrusted sources and consider disabling or removing the WPG importer plugin (plug-ins/wpg/) if it is not required. Running Dia in a sandbox (e.g., Flatpak with restricted file access, Firejail, or a container) can limit the blast radius of exploitation. Organizations should monitor the GNOME Dia GitLab repository and downstream distribution security advisories for patch availability (GitHub Advisory, Red Hat CVE).

Red Hat Product Security assessed the vulnerability and confirmed it does not affect any currently supported Red Hat product, crediting reporter Robin "drzobin" Larsson for the disclosure (Red Hat CVE). A Mastodon post referencing the CVE was observed shortly after disclosure, indicating some community awareness, though broader security media coverage has been limited given the niche nature of the affected software.