CVE-2026-77658 – GNOME Dia
“Crafted diagram files can corrupt memory and potentially turn routine file opening into code execution.”
GNOME Dia is affected by two High-severity memory corruption vulnerabilities. CVE-2026-77652 is a heap-based buffer overflow in the WPG file importer that can be triggered by a malicious WPG file and may cause crashes or potentially arbitrary code execution. The CVSS score is 7.8, which is High severity.
CVE-2026-77658 is a stack-based buffer overflow in Network Bus object handling within Dia project files. An attacker can supply an excessive handle count and trigger stack exhaustion or memory corruption when the object is manipulated. The CVSS score is 7.8, which is High severity. Public proof-of-concept material is available for both vulnerabilities.
Key Details
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-121