CVE-2026-53910

Name of the Vulnerable Software and Affected Versions GNU diffutils diff3 (affected versions not specified)

Description The diff3 tool contains a heap-based buffer overflow resulting from multiple signed integer overflows during line-mapping calculations. Incorrect arithmetic when mapping line ranges can lead to corrupted values being used for loop bounds and memory allocation. If an attacker controls the output of the diff program used by diff3, such as by using the --diff-program parameter to point to a malicious script, they can trigger out-of-bounds writes. This may result in an application crash or potentially remote code execution.

Recommendations Apply the fix provided in commit 9ff04d5b84743e331e80b589335a52c5480d1815. Avoid using the --diff-program parameter with untrusted or malicious scripts.