UBUNTU-CVE-2026-77658

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-77658
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-77658
Upstream
  • CVE-2026-77658
Published
2026-08-26T13:19:00Z
Modified
2026-09-02T19:36:34.331426294Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload() reads the number of bus handles from the file attribute "bushandles" using attributenumdata() without validating an upper bound: bus->numhandles = attributenumdata(attr); When a bus handle is subsequently moved, bushandlemoved() allocates two temporary arrays on the stack: parallel = (real *)galloca(numhandles * sizeof(real)); perp = (real *)galloca(numhandles * sizeof(real)); Because numhandles is fully attacker-controlled via the project file, sufficiently large values (for example 262144 or higher) cause galloca() to consume more stack space than the default thread stack limit (typically 8 MB on Linux), resulting in stack overflow, SIGSEGV, and potential stack frame / return-address corruption. An attacker can embed a Bus object with an excessive bushandles count in a malicious .dia file. Exploitation requires the victim to open the file in Dia (file dialog, command line, or file association) and trigger handle manipulation (moving a bus handle), which exercises the vulnerable code path. The identical g_alloca pattern is present in objects/Misc/tree.c (copied from bus.c) and is likely vulnerable to the same class of attack via Tree objects. Affected versions: Dia 0.98.0 and earlier versions containing this code; issue confirmed on upstream master as of 2026-08-21. Upstream report: https://gitlab.gnome.org/GNOME/dia/-/issues/581

References

Affected packages

Ubuntu:16.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dia",
            "binary_version": "0.97.3-1"
        },
        {
            "binary_name": "dia-common",
            "binary_version": "0.97.3-1"
        },
        {
            "binary_name": "dia-gnome",
            "binary_version": "0.97.3-1"
        },
        {
            "binary_name": "dia-libs",
            "binary_version": "0.97.3-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json"
Ubuntu:18.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20160930-6
0.97.3+git20160930-7
0.97.3+git20160930-8

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dia",
            "binary_version": "0.97.3+git20160930-8"
        },
        {
            "binary_name": "dia-common",
            "binary_version": "0.97.3+git20160930-8"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json"
Ubuntu:20.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20160930-8.1
0.97.3+git20160930-8.2
0.97.3+git20160930-9

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dia",
            "binary_version": "0.97.3+git20160930-9"
        },
        {
            "binary_name": "dia-common",
            "binary_version": "0.97.3+git20160930-9"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json"
Ubuntu:22.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20160930-9
0.97.3+git20160930-9build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dia",
            "binary_version": "0.97.3+git20160930-9build1"
        },
        {
            "binary_name": "dia-common",
            "binary_version": "0.97.3+git20160930-9build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json"
Ubuntu:24.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.3+git20220525-5build1
0.97.3+git20220525-5build2
0.97.3+git20220525-5build3
0.98+git20240130-1
0.98+git20240130-1build2
0.98+git20240130-1build3
0.98+git20240130-1build4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dia",
            "binary_version": "0.98+git20240130-1build4"
        },
        {
            "binary_name": "dia-common",
            "binary_version": "0.98+git20240130-1build4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json"
Ubuntu:26.04:LTS
dia

Package

Name
dia
Purl
pkg:deb/ubuntu/dia?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.98+git20250902-0ubuntu1
0.98+git20250902-0ubuntu2
0.98+git20260221-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dia",
            "binary_version": "0.98+git20260221-1"
        },
        {
            "binary_name": "dia-common",
            "binary_version": "0.98+git20260221-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77658.json"