Skip to content
Fencer Intel
low 2.1

CVE-2026-53910 json

Heap-based Buffer Overflow in GNU diffutils

published 3mo ago modified 18d ago also EUVD-2026-47695

cvss
2.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.

This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815

NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.

Patch / fix

  • diffutils Ubuntu 22.04 LTS 1:3.8-0ubuntu2.1
  • diffutils Ubuntu 24.04 LTS 1:3.10-1ubuntu0.1
  • diffutils Ubuntu 26.04 LTS 1:3.12-1ubuntu0.1
  • diffutils Ubuntu Pro 14.04 LTS 1:3.3-1ubuntu0.1~esm1
  • diffutils Ubuntu Pro 16.04 LTS 1:3.3-3ubuntu0.1~esm1
  • diffutils Ubuntu Pro 18.04 LTS 1:3.6-1ubuntu0.1~esm1
  • diffutils Ubuntu Pro 20.04 LTS 1:3.7-3ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-53910

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • diffutils hummingbird 1 3.12-6.1.hum1

red hat advisories RHSA-2026:45327

Is CVE-2026-53910 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53910 updated cvss 5.3

diffutils: heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations

  • Red Hat Enterprise Linux 6 diffutils Red Hat Enterprise Linux 7 diffutils Red Hat Enterprise Linux 8 diffutils Red Hat Enterprise Linux 9 diffutils Red Hat Enterprise Linux 10 diffutils Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    +1 more products
    Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “To mitigate this vulnerability, do not run the diff3 program with untrusted input for the --diff-program argument or process untrusted diff output.”
  • Red Hat Hardened Images diffutils 3.12-6.1.hum1
    fixed: vendor fix “To mitigate this vulnerability, do not run the diff3 program with untrusted input for the --diff-program argument or process untrusted diff output.” RHSA-2026:45327

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • GNU diffutils

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.