PT-2026-3271 · Dia · Dia

Published 2026-01-16 · Updated 2026-01-17 · CVE-2025-15032

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dia versions prior to 1.9.0

Description A flaw exists in Dia that, on macOS, could allow an attacker to spoof a trusted domain in the window title of custom-sized new windows. This could mislead users about the current site due to a missing 'about:blank' indicator.

Recommendations Update to Dia version 1.9.0 or later.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-15032

Affected Products

Dia

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-15032 · Security Note
• https://twitter.com/CVEnew/status/2012303229426843780 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2012381343628358049 · Twitter Post
• https://diabrowser.com/security/bulletins#CVE-2025-15032 · Note