Dia CVE-2026-77658

Exploitation requires two sequential victim interactions: first, the victim must open a malicious .dia XML project file in Dia (via file dialog, command-line invocation, or OS file association); second, the victim must move a bus handle within the diagram, triggering the bus_handle_moved() code path where the unvalidated num_handles value drives the oversized g_alloca() calls. The file must contain a Network Bus object (or Tree object for the secondary path in tree.c) with bus_handles set to a sufficiently large value (262144 or higher on typical Linux with 8 MB stack). Exploitation is limited by: the two-step user interaction requirement (CVSS UI:R), the local attack vector requiring file delivery to the victim's machine (CVSS AV:L), the non-default state of having Bus or Tree objects present in the diagram, and the absence of any network-facing exposure. No special privileges, authentication, or non-default configuration of the operating system or Dia itself is required beyond the victim using the application normally.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the threat model: local file delivery with two-step user interaction (open file, then move a handle) is required, but no privileges are needed and no special configuration is required beyond using the application's normal diagramming workflow. The high C/I/A ratings are justified given that stack-frame corruption can redirect control flow. EPSS data was not provided; KEV status is absent, confirming no public exploitation has been reported to CISA. The technical depth of the GitLab issue (specific line numbers, example trigger values, secondary affected file) lowers the barrier to POC development significantly, making this a credible near-term risk despite the lack of a current exploit. Real-world blast radius is constrained by Dia's niche deployment footprint - this is not a server-side or network-exposed vulnerability - and the delivery model depends on social engineering to get a target to open a file and interact with a Bus or Tree object, which requires some victim cooperation beyond a single click.

An attacker emails a crafted .dia file to a network engineer or architect who uses Dia professionally, embedding a Bus object with bus_handles set to 262144. When the victim opens the file and moves any bus handle during a normal diagram editing session, bus_handle_moved() executes the vulnerable g_alloca() calls, exhausting the stack and causing a SIGSEGV that - with additional exploit development beyond the disclosed crash - could be directed toward stack-frame corruption and arbitrary code execution. No public POC exists at time of analysis, but the GitLab issue provides line-level detail sufficient for a skilled researcher to build one.