Stack-Based Buffer Overflow Vulnerability in Dia Diagram Editor

CVE-2026-77658

What is CVE-2026-77658?

A stack-based buffer overflow vulnerability has been identified in the Dia Diagram Editor, specifically when processing Network Bus objects from Dia XML project files. The flaw occurs in the bus_load() function, where the number of bus handles is read from an attribute file without enforcing an upper limit. An attacker can exploit this vulnerability by creating a malicious .dia file with a high bus handle count, leading to excessive stack space allocation that exceeds the thread stack limit. Consequently, this can result in a SIGSEGV error and corruption of the stack frame and return-address. Users must be cautious while opening .dia files to prevent exploitation and system crashes. Notably, a similar vulnerability exists in Tree objects within Dia, indicating a broader risk.

References