A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.<\/p>\n
In plug-ins\/wpg\/wpg-import.c, the WPG import renderer allocates a fixed palette with:<\/p>\n
ren->pPal = g_new0(WPGColorRGB, 256);<\/p>\n
When handling a WPG_COLORMAP record, the parser reads a start index (i16) and number of colors (iNum16) from the file and reads palette data with:<\/p>\n
bRet &= (iNum16 == (int)fread(&ren->pPal[i16], sizeof(WPGColorRGB), iNum16, f));<\/p>\n
The only bounds-related check is `if (i16 >= 0 && i16 <= iSize)`, where iSize is the WPG record size\u2014not the palette capacity. There is no validation that i16 is less than 256 or that i16 + iNum16 does not exceed 256.<\/p>\n
A malicious WPG file can supply i16=256 and iNum16=264. That causes fread() to write 792 bytes starting at &pPal[256], while the palette buffer is only 768 bytes (256 entries \u00d7 3 bytes). This overflows into adjacent heap metadata and can crash Dia (SIGABRT \/ malloc corruption errors) or, depending on heap layout and exploit primitives, potentially lead to arbitrary code execution.<\/p>\n
Exploitation requires convincing a user to open a crafted WPG file via Dia's file dialog, command line, or file association. No special privileges are required to deliver the file to the victim.<\/p>\n
Affected component: WPG parser (plug-ins\/wpg\/wpg-import.c).
\nAffected versions: all Dia versions containing this code path (reporter tested Dia 0.98+git20260221-1; issue present on upstream master as of 2026-08-21).<\/p>\n","protected":false},"excerpt":{"rendered":"
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer.<\/p>\n
In plug-ins\/wpg\/wpg-import.c, the WPG import renderer allocates a fixed palette with:<\/p>\n
ren->p<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12031","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}