UBUNTU-CVE-2026-77652

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-77652
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-77652
Upstream
  • CVE-2026-77652
Published
2026-08-26T20:18:00Z
Modified
2026-09-02T19:36:34.286159216Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = gnew0(WPGColorRGB, 256); When handling a WPGCOLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with: bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f)); The only bounds-related check is if (i16 >= 0 && i16 <= iSize), where iSize is the WPG record size—not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256. A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries × 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT / malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution. Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim. Affected component: WPG parser (plug-ins/wpg/wpg-import.c). Affected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).

References

Affected packages

Ubuntu:16.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.97.3-1",
            "binary_name": "dia"
        },
        {
            "binary_version": "0.97.3-1",
            "binary_name": "dia-common"
        },
        {
            "binary_version": "0.97.3-1",
            "binary_name": "dia-gnome"
        },
        {
            "binary_version": "0.97.3-1",
            "binary_name": "dia-libs"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"
Ubuntu:18.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20160930-6
0.97.3+git20160930-7
0.97.3+git20160930-8

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.97.3+git20160930-8",
            "binary_name": "dia"
        },
        {
            "binary_version": "0.97.3+git20160930-8",
            "binary_name": "dia-common"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"
Ubuntu:20.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20160930-8.1
0.97.3+git20160930-8.2
0.97.3+git20160930-9

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.97.3+git20160930-9",
            "binary_name": "dia"
        },
        {
            "binary_version": "0.97.3+git20160930-9",
            "binary_name": "dia-common"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"
Ubuntu:22.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20160930-9
0.97.3+git20160930-9build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.97.3+git20160930-9build1",
            "binary_name": "dia"
        },
        {
            "binary_version": "0.97.3+git20160930-9build1",
            "binary_name": "dia-common"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"
Ubuntu:24.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20220525-5build1
0.97.3+git20220525-5build2
0.97.3+git20220525-5build3
0.98+git20240130-1
0.98+git20240130-1build2
0.98+git20240130-1build3
0.98+git20240130-1build4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.98+git20240130-1build4",
            "binary_name": "dia"
        },
        {
            "binary_version": "0.98+git20240130-1build4",
            "binary_name": "dia-common"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"
Ubuntu:26.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.98+git20250902-0ubuntu1
0.98+git20250902-0ubuntu2
0.98+git20260221-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.98+git20260221-1",
            "binary_name": "dia"
        },
        {
            "binary_version": "0.98+git20260221-1",
            "binary_name": "dia-common"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77652.json"