Dia CVE-2026-77652

Exploitation requires the victim to actively open a crafted WPG file using Dia - this can occur via the application's file dialog, a command-line invocation (dia file.wpg), or a registered desktop file association that launches Dia automatically when a .wpg file is double-clicked. The WPG import plug-in must be present and loadable, which is the default in standard Dia installations. No authentication, network access, or elevated privileges are required of the attacker; the attack surface is entirely within the file-parsing code path. The limiting factors are mandatory user interaction (the victim must open the file) and the local attack vector (the attacker must get the file to the victim's filesystem via a social-engineering vector such as email, web download, or shared drive). No special Dia configuration or non-default settings are required to trigger the overflow.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.8 and accurately reflects the attack surface: exploitation is local and file-triggered rather than network-exposed, substantially lowering opportunistic reach. AC:L indicates that once a victim opens a crafted file the overflow fires reliably - no race conditions or complex heap grooming are required for a crash, though escalating to consistent code execution will depend on heap layout and platform allocator behavior. No EPSS data was supplied and the CVE is absent from the CISA KEV catalog, so widespread in-the-wild exploitation is not confirmed. The combination of confirmed reproducibility (reporter provided exact i16=256/iNum16=264 parameters tested on Dia 0.98+git20260221-1), low attack complexity, and high C/I/A impact makes this a genuine medium-high priority for any organization or user that routinely processes WPG diagrams - even a small IT team supporting legacy CAD or documentation workflows should treat this as urgent patching work once a fix is available. The absence of network reachability (AV:L) and mandatory user interaction (UI:R) meaningfully reduce mass-exploitation risk compared to the raw CVSS score might suggest.

An attacker crafts a WPG file containing a COLORMAP record with i16=256 and iNum16=264, then delivers it to a target user via email attachment, download link, or shared network drive. When the victim opens the file through Dia's file dialog, command-line invocation, or a registered file association, the WPG parser calls fread() writing 792 bytes into a 768-byte heap buffer, corrupting adjacent heap metadata. On most Linux allocators this immediately triggers a SIGABRT or malloc corruption abort; with sufficient heap-layout knowledge an attacker may be able to redirect control flow and achieve arbitrary code execution in the context of the victim user.