Gnome Dia vulnerabilities

3 CVEs affecting Gnome Dia, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77652, published 2026-08-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-19451, published 2019-11-29. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this…
CVE-2026-77652, published 2026-08-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: …
CVE-2026-77658, published 2026-08-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bus_load() reads the number of…