EUVD-2026-66417Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L because exploitation requires local file delivery and execution; UI:R for the two-step open-then-interact requirement; PR:N as no credentials or elevated privileges are needed to open a file.
Primary rating from Vendor (fedora).
CVSS VectorVendor: fedora
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files.
In objects/network/bus.c, bus_load() reads the number of bus handles from the file attribute "bus_handles" using attribute_num_data() without validating an upper bound:
bus->num_handles = attribute_num_data(attr);
When a bus handle is subsequently moved, bus_handle_moved() allocates two temporary arrays on the stack:
parallel = (real *)g_alloca(num_handles * sizeof(real)); perp = (real *)g_alloca(num_handles * sizeof(real));
Because num_handles is fully attacker-controlled via the project file, sufficiently large values (for example 262144 or higher) cause g_alloca() to consume more stack space than the default thread stack limit (typically 8 MB on Linux), resulting in stack overflow, SIGSEGV, and potential stack frame / return-address corruption.
An attacker can embed a Bus object with an excessive bus_handles count in a malicious .dia file. Exploitation requires the victim to open the file in Dia (file dialog, command line, or file association) and trigger handle manipulation (moving a bus handle), which exercises the vulnerable code path.
The identical g_alloca pattern is present in objects/Misc/tree.c (copied from bus.c) and is likely vulnerable to the same class of attack via Tree objects.
Affected versions: Dia 0.98.0 and earlier versions containing this code; issue confirmed on upstream master as of 2026-08-21. Upstream report: https://gitlab.gnome.org/GNOME/dia/-/issues/581
AnalysisAI
Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential victim interactions: first, the victim must open a malicious .dia XML project file in Dia (via file dialog, command-line invocation, or OS file association); second, the victim must move a bus handle within the diagram, triggering the bus_handle_moved() code path where the unvalidated num_handles value drives the oversized g_alloca() calls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the threat model: local file delivery with two-step user interaction (open file, then move a handle) is required, but no privileges are needed and no special configuration is required beyond using the application's normal diagramming workflow. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker emails a crafted .dia file to a network engineer or architect who uses Dia professionally, embedding a Bus object with bus_handles set to 262144. When the victim opens the file and moves any bus handle during a normal diagram editing session, bus_handle_moved() executes the vulnerable g_alloca() calls, exhausting the stack and causing a SIGSEGV that - with additional exploit development beyond the disclosed crash - could be directed toward stack-frame corruption and arbitrary code execution. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the upstream GitLab issue at https://gitlab.gnome.org/GNOME/dia/-/issues/581 confirms the issue on master but no fixed tagged release is noted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running GNOME Dia 0.98.0 or earlier; restrict application access and alert users to avoid opening .dia files from email, web downloads, or untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process cras
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encod
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today