Executive brief
Dia is a diagram editor used for creating technical drawings and flowcharts. A stack buffer overflow vulnerability in Dia allows an attacker to crash the application or potentially execute code by crafting a malicious diagram file with specially crafted bus objects. An end user opening such a file and manipulating bus handles would trigger the vulnerability.
Technical details
A stack-based buffer overflow exists in objects/network/bus.c where the bus_load() function reads an unbounded "bus_handles" attribute from Dia XML project files without validation. When a bus handle is moved, bus_handle_moved() allocates temporary arrays on the stack using g_alloca() with a size controlled by the attacker-supplied bus_handles count. Sufficiently large values (e.g., 262144+) exhaust the thread stack limit (typically 8 MB), causing stack overflow, SIGSEGV, and potential return address corruption. Exploitation requires a victim to open a malicious .dia file and interact with bus handles. An identical vulnerable pattern exists in objects/Misc/tree.c affecting Tree objects. Patches are not yet available as of the advisory date.
Affected products
- GNOME Dia 0.98.0 and earlier
Timeline
- 2026-08-26: disclosed
- 2026-08-21: other: Issue confirmed on upstream master