2.1
LOW CVSS 4.0
CVE-2026-53910
Heap-based Buffer Overflow in GNU diffutils
Description

diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815

INFO

Published Date :

July 22, 2026, 2:17 p.m.

Last Modified :

July 22, 2026, 2:17 p.m.

Remotely Exploit :

No
Affected Products

The following products are affected by CVE-2026-53910 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 4.0 LOW 4bb8329e-dd38-46c1-aafb-9bf32bcb93c6
CVSS 4.0 LOW [email protected]
Solution
Fix heap-based buffer overflow by updating diffutils.
  • Update GNU diffutils to the latest version.
  • Apply the security patch for commit 9ff04d5b84743e331e80b589335a52c5480d1815.
  • Ensure diff-program is not controlled by untrusted input.
References to Advisories, Solutions, and Tools
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-53910 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-53910 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-53910 vulnerability anywhere in the article.

  • cert.pl
Vulnerability in GNU diffutils software

Vulnerability in GNU diffutils software CVE ID CVE-2026-53910 Publication date 22 July 2026 Vendor GNU Product diffutils Vulnerable versions All through 3.12 Vulnerability type (CWE) Integer Overflow ... Read more

Published Date: Jul 22, 2026 (1 hour, 51 minutes ago)

The following table lists the changes that have been made to the CVE-2026-53910 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by [email protected]

    Jul. 22, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.savannah.gnu.org/cgit/diffutils.git/', 'vendor': 'GNU', 'modules': ['diff3'], 'product': 'diffutils', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '3.12'}], 'defaultStatus': 'unaffected'}]
    Added Description diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
    Added CVSS V4.0 AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-190
    Added Reference https://cert.pl/en/posts/2026/07/CVE-2026-53910
    Added Reference https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
    Added Reference https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815
    Added Reference https://git.savannah.gnu.org/cgit/diffutils.git/
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.