CVE-2026-77652 Overview
CVE-2026-77652 is a heap-based buffer overflow [CWE-122] in the WordPerfect Graphics (WPG) file format importer of the Dia diagram editor. The flaw resides in plug-ins/wpg/wpg-import.c, where the WPG import renderer allocates a fixed 256-entry palette but fails to validate offsets when parsing a WPG_COLORMAP record. An attacker who convinces a user to open a crafted WPG file can overflow the palette buffer, corrupt adjacent heap metadata, and potentially achieve arbitrary code execution in the context of the Dia process.
Critical Impact
A malicious WPG file processed by Dia can trigger heap corruption leading to application crash or arbitrary code execution under the victim's user account.
Affected Products
- GNOME Dia diagram editor (all versions containing the vulnerable WPG import code path)
- Dia 0.98+git20260221-1 (confirmed by reporter)
- Upstream Dia master branch as of 2026-08-21
Discovery Timeline
- 2026-08-26 - CVE-2026-77652 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77652
Vulnerability Analysis
The vulnerability exists in Dia's WPG plug-in, which parses WordPerfect Graphics files during import. The renderer allocates a fixed-size palette buffer using g_new0(WPGColorRGB, 256), producing 768 bytes of heap storage for 256 three-byte RGB entries. When the parser encounters a WPG_COLORMAP record, it reads a start index i16 and a color count iNum16 directly from the untrusted file and passes them to fread() without validating them against the palette capacity.
The only bounds check performed is if (i16 >= 0 && i16 <= iSize), where iSize refers to the WPG record size rather than the 256-entry palette limit. As a result, both i16 and iNum16 remain attacker-controlled, and the write destination &ren->pPal[i16] can fall entirely outside the allocated buffer.
Root Cause
The root cause is missing input validation on file-supplied indices [CWE-122]. The parser trusts i16 and iNum16 values read from the WPG stream and does not verify that i16 < 256 or that i16 + iNum16 <= 256 before invoking fread() into ren->pPal[i16]. Combined with a fixed-capacity allocation, this creates a linear heap write primitive.
Attack Vector
Exploitation is local and requires user interaction. An attacker crafts a WPG file supplying i16=256 and iNum16=264, causing fread() to write 792 bytes starting 768 bytes past the base of the palette. The write overruns the palette allocation, corrupting adjacent heap metadata and typically producing SIGABRT or malloc corruption errors. Depending on heap layout and available primitives, an attacker may convert the overflow into arbitrary code execution.
Delivery vectors include email attachments, drive-by downloads, shared network drives, or any workflow that induces a user to open the file through Dia's file dialog, command line, or a file-type association. No elevated privileges are required to deliver the file.
For implementation details, see the GNOME Dia WPG Import Code and GNOME Dia Issue #580.
Detection Methods for CVE-2026-77652
Indicators of Compromise
- Dia process crashes with SIGABRT, glibc malloc corruption messages, or free(): invalid pointer output during or immediately after opening a WPG file.
- Presence of unsolicited or unexpected .wpg files in user download, email attachment, or temporary directories.
- Core dumps generated by Dia referencing the wpg-import.c call stack or read_ColorMap frames.
Detection Strategies
- Inspect WPG files for WPG_COLORMAP records where the start index plus color count exceeds 256; such combinations are invalid for legitimate files.
- Monitor endpoint telemetry for Dia child processes spawning shells, scripting interpreters, or network utilities shortly after file open events.
- Enable heap hardening features such as glibc MALLOC_CHECK_=3 or AddressSanitizer builds during triage to surface the corruption at the point of overflow.
Monitoring Recommendations
- Log file open events for the dia binary and correlate with subsequent process crashes or unusual child process creation.
- Alert on WPG file transfers arriving via email gateways or web proxies, given the format's low legitimate business use in most environments.
- Track deployed Dia versions across Linux endpoints to identify hosts still running vulnerable builds after patch availability.
How to Mitigate CVE-2026-77652
Immediate Actions Required
- Restrict or disable the WPG import plug-in on systems where WordPerfect Graphics support is not required.
- Instruct users not to open WPG files from untrusted sources until a patched Dia build is deployed.
- Remove or rename the WPG plug-in shared object from the Dia plug-in directory to prevent loading of the vulnerable parser.
Patch Information
At publication time, no fixed release is referenced in the enriched CVE data. Track the Red Hat CVE-2026-77652 advisory and Red Hat Bug Report #2520884 for distribution updates, and monitor GNOME Dia Issue #580 for the upstream fix. A proper patch must validate that i16 < 256 and i16 + iNum16 <= 256 before invoking fread() into the palette buffer.
Workarounds
- Disable the WPG plug-in by removing libwpg_filter.so (or the equivalent plug-in file for your distribution) from the Dia plug-ins directory.
- Enforce application allowlisting or MIME-type filtering to block .wpg files at email and web gateways.
- Run Dia under a restricted user account or within a sandbox such as Firejail or Bubblewrap to limit the blast radius of successful exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
