CVE-2026-53910

A flaw was found in the diff3 program in the diffutils package. When processing specially crafted diff output, a heap-based buffer overflow can occur due to multiple signed integer overflows in line-mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds, resulting in a denial of service or memory corruption.

To exploit this vulnerability, an attacker needs to be able to control the output of the diff program used by diff3 (e.g., via --diff-program pointing to a malicious script) or convince a user to execute diff3 with specially crafted diff output. An attacker often needs prior execution privileges to supply the malicious diff output, meaning they already have the ability to execute arbitrary scripts on the system. Due to these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, do not run the diff3 program with untrusted input for the --diff-program argument or process untrusted diff output.