GNU diffutils diff3 buffer overflow disclosed

A heap-based buffer overflow in GNU diffutils' diff3 tool, caused by signed integer overflows, can lead to crashes or potential remote code execution.

CERT Polska coordinated the disclosure of CVE-2026-53910, a vulnerability affecting the diff3 tool within GNU diffutils. The flaw stems from multiple signed integer overflows in line-mapping calculations, where incorrect arithmetic can corrupt values used for memory allocation and loop bounds. This can cause the application to allocate insufficient memory and subsequently perform out-of-bounds writes when processing crafted diff output.

Exploitation requires an attacker to control the output of the diff program invoked by diff3, for example by leveraging the --diff-program option to point to a malicious script. Under these conditions, the out-of-bounds writes can result in a crash and, depending on the environment, potentially remote code execution. The issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815, and credit for the responsible disclosure was given to researchers Michał Majchrowicz and Marcin Wyczechowski from AFINE Team.

This is a coordinated vulnerability disclosure with no evidence of in-the-wild exploitation noted in the report. Given the specific attacker precondition required (control over the diff-program output), real-world exploitability is limited to scenarios where diff3 processes untrusted or attacker-influenced configuration or input.

title: diff3 Invoked with Custom --diff-program Pointing to Script Interpreter
description: Detects execution of diff3 with the --diff-program option redirecting
  output generation to a script or interpreter rather than a standard diff binary.
  This is the attacker-controlled precondition required to trigger CVE-2026-53910
  (signed integer overflow in diff3 line-mapping leading to out-of-bounds writes).
  Generalises on the flag and suspicious target, not on any specific script name.
tags:
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /diff3
    CommandLine|contains: --diff-program
  suspicious_target:
    CommandLine|contains:
    - --diff-program=/tmp/
    - --diff-program=/dev/shm/
    - --diff-program=/var/tmp/
    - --diff-program=sh
    - --diff-program=bash
    - --diff-program=python
    - --diff-program=perl
    - --diff-program=./
  filter_standard_diff:
    CommandLine|contains:
    - --diff-program=/usr/bin/diff
    - --diff-program=/bin/diff
  condition: selection and suspicious_target and not filter_standard_diff
falsepositives:
- Build systems or CI pipelines that legitimately wrap diff invocation in a custom
  shell script for formatting purposes
- Developers testing custom diff backends during diffutils development
level: medium
id: 57760edd-614a-5ec9-a0a5-c21cdc49ac4e
status: experimental
author: Vorant

title: Unexpected Child Process Spawned by diff3
description: diff3 is a text comparison utility that does not normally spawn interpreters
  or shells as children. Observing such child processes suggests either a malicious
  --diff-program payload executing, or memory corruption from CVE-2026-53910 leading
  to unexpected code execution.
tags:
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /diff3
  suspicious_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /nc
    - /curl
    - /wget
  condition: selection and suspicious_child
falsepositives:
- Custom diff-program wrapper scripts explicitly configured by an administrator for
  legitimate formatting/merge tooling
level: medium
id: 62ba436d-150f-5d63-b0bc-8330d899a066
status: experimental
author: Vorant

title: diff3 Process Crash Following Large or Malformed Input Processing
description: Detects diff3 terminating abnormally (segmentation fault / core dump
  logged) which may indicate triggering of the signed integer overflow and out-of-bounds
  write documented in CVE-2026-53910. This behavioural signal should be combined with
  process creation context showing a custom --diff-program to increase confidence.
tags:
- attack.impact
- attack.t1499
logsource:
  product: linux
  service: syslog
detection:
  selection:
    Image|endswith: /diff3
  crash_indicators:
    Message|contains:
    - segfault
    - core dumped
    - SIGSEGV
  condition: selection and crash_indicators
falsepositives:
- Unrelated diff3 crashes caused by corrupted or truncated input files unrelated to
  exploitation attempts
- Resource-constrained systems killing diff3 via OOM killer, which may log similarly
level: low
id: 70541d10-2ec2-5187-9f14-824cda9ac9e7
status: experimental
author: Vorant

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-53910