Dia is a lightweight, open-source diagram and flowchart editor with a narrow but persistent vulnerability footprint concentrated in its core drawing application. The vendor's disclosures recur around memory-safety and input-handling weaknesses, particularly format-string vulnerabilities and buffer-boundary issues that are characteristic of legacy C-based graphics software, and frequently acquire public exploit code. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dia over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2006-2480MEDIUM Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as | May 19, 2006 | 5.1 | 27 | NO | YES |
CVE-2007-3408HIGH Multiple unspecified vulnerabilities in Dia before 0.96.1-6 have unspecified attack vectors and impact, probably involving the use of vulnerable FreeType libraries that contain CVE | Jun 26, 2007 | 7.5 | 21 | NO | NO |
CVE-2006-2453HIGH Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, a different set of issues than CVE-2006-2480. | May 28, 2006 | 7.5 | 20 | NO | NO |
CVE-2006-1550HIGH Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig | Mar 30, 2006 | 7.6 | 20 | NO | NO |
CVE-2008-5984MEDIUM Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in | Jan 28, 2009 | 6.9 | 18 | NO | NO |
CVE-2005-2966MEDIUM The Python SVG import plugin (diasvg_import.py) for DIA 0.94 and earlier allows user-assisted attackers to execute arbitrary commands via a crafted SVG file. | Oct 5, 2005 | 5.1 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dia.
Media articles that mention a CVE ID that affects a product developed by Dia — matched by CVE ID, not by vendor name.