Executive brief
Dia is a free diagram editor used to create flowcharts, UML diagrams, and other technical drawings. A heap buffer overflow vulnerability in the WPG (WordPerfect Graphics) file format importer allows attackers to crash the application or potentially execute arbitrary code by tricking users into opening a specially crafted WPG file. No special privileges are required, and the file can be delivered via email or file sharing.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) in the WPG file parser (plug-ins/wpg/wpg-import.c, line 616) where a fixed-size palette buffer (256 entries, 768 bytes total) is accessed without proper bounds checking. The vulnerable code reads a start index (i16) and count (iNum16) from the WPG_COLORMAP record and directly writes palette data at &ren->pPal[i16] without validating that i16 is less than 256 or that i16 + iNum16 does not exceed 256. By supplying i16=256 and iNum16=264, an attacker can write 792 bytes to a 768-byte buffer, overwriting adjacent heap metadata including chunk headers, forward/backward pointers, and tcache structures. The overflow can trigger malloc corruption (SIGABRT), denial of service, or enable heap exploitation primitives such as tcache poisoning or unlink attacks for arbitrary code execution. Exploitation requires user interaction to open the malicious WPG file, with no authentication or privilege elevation needed.
Affected products
- GNOME Dia 0.98+git20260221-1 and all earlier versions
Timeline
- 2026-08-26: disclosed: Vulnerability published
- 2026-08-21: other: Issue confirmed present on upstream master branch