Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Dia's WPG (WordPerfect Graphics) import plugin. When parsing a WPG COLORMAP record, the colormap start index and entry count taken from the file are not validated against the fixed 256-entry palette buffer. A crafted WPG file can cause a heap-based buffer overflow in plug-ins/wpg/wpg-import.c, leading to memory corruption, application crash, and potentially arbitrary code execution if a victim opens the malicious file in Dia. Upstream GitLab issue #580 was closed without a fix.