CVE-2026-77652

Name of the Vulnerable Software and Affected Versions Dia (affected versions not specified)

Description A heap-based buffer overflow exists in the WPG file format importer. The issue occurs in the WPG import renderer within the plug-ins/wpg/wpg-import.c component. When processing a WPG COLORMAP record, the parser fails to validate that the start index i16 and the number of colors iNum16 do not exceed the fixed palette capacity of 256 entries. A specially crafted WPG file can trigger an overflow by providing values that cause fread() to write beyond the allocated buffer, potentially leading to application crashes or arbitrary code execution.

Recommendations Restrict the use of untrusted WPG files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.