#1142675 diffutils: CVE-2026-53910

Package:
src:diffutils
Source:
src:diffutils
Submitter:
Salvatore Bonaccorso
Date:
2026-07-25 11:39:02 UTC
Severity:
normal
Tags:
#1142675#5
Date:
2026-07-24 06:10:04 UTC
From:
To:
Hi,

The following vulnerability was published for diffutils.

CVE-2026-53910[0]:
| diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer
| overflow due to multiple signed integer overflows in line‑mapping
| calculations. Incorrect arithmetic in mapping line ranges can result
| in corrupted values being used for memory allocation and loop
| bounds. When processing crafted diff output, these overflows may
| cause the application to allocate insufficient memory and
| subsequently perform out‑of‑bounds writes during internal
| processing.  An attacker who can control the output of the diff
| program used by diff3 (e.g. via --diff-program pointing to a
| malicious script) can trigger out-of-bounds writes, resulting in a
| crash and potentially remote code execution depending on the
| environment.   This issue has been fixed in commit
| 9ff04d5b84743e331e80b589335a52c5480d1815


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53910
https://www.cve.org/CVERecord?id=CVE-2026-53910
[1] https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
[2] https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
#1142675#10
Date:
2026-07-24 11:06:16 UTC
From:
To:
Hello.

I received this from the Debian BTS. (Thank you, Salvatore)

The report says this is fixed in [9ff04d5], but it also mentions
[73ed7ce], and when I do "git log" in my clone I also find additional
security-related commits in addition to those two.

So: How many commits should I really apply from the git repo to fix
CVE-2026-53910 ?

Also, while we are at it: Can I expect a diffutils 3.13 release soon?

Thanks.

----- Forwarded message from Salvatore Bonaccorso <carnil@debian.org> -----

Date: Fri, 24 Jul 2026 08:10:04 +0200
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#1142675: diffutils: CVE-2026-53910
Resent-CC: carnil@debian.org, team@security.debian.org, sanvila@debian.org
X-Mailer: reportbug 13.2.0+nmu1

Source: diffutils
Version: 1:3.12-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for diffutils.

CVE-2026-53910[0]:
| diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer
| overflow due to multiple signed integer overflows in line‑mapping
| calculations. Incorrect arithmetic in mapping line ranges can result
| in corrupted values being used for memory allocation and loop
| bounds. When processing crafted diff output, these overflows may
| cause the application to allocate insufficient memory and
| subsequently perform out‑of‑bounds writes during internal
| processing.  An attacker who can control the output of the diff
| program used by diff3 (e.g. via --diff-program pointing to a
| malicious script) can trigger out-of-bounds writes, resulting in a
| crash and potentially remote code execution depending on the
| environment.   This issue has been fixed in commit
| 9ff04d5b84743e331e80b589335a52c5480d1815


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53910
https://www.cve.org/CVERecord?id=CVE-2026-53910
[1] https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
[2] https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore



----- End forwarded message -----
#1142675#13
Date:
2026-07-24 11:06:16 UTC
From:
To:
Hello.

I received this from the Debian BTS. (Thank you, Salvatore)

The report says this is fixed in [9ff04d5], but it also mentions
[73ed7ce], and when I do "git log" in my clone I also find additional
security-related commits in addition to those two.

So: How many commits should I really apply from the git repo to fix
CVE-2026-53910 ?

Also, while we are at it: Can I expect a diffutils 3.13 release soon?

Thanks.

----- Forwarded message from Salvatore Bonaccorso <carnil@debian.org> -----

Date: Fri, 24 Jul 2026 08:10:04 +0200
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#1142675: diffutils: CVE-2026-53910
Resent-CC: carnil@debian.org, team@security.debian.org, sanvila@debian.org
X-Mailer: reportbug 13.2.0+nmu1

Source: diffutils
Version: 1:3.12-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for diffutils.

CVE-2026-53910[0]:
| diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer
| overflow due to multiple signed integer overflows in line‑mapping
| calculations. Incorrect arithmetic in mapping line ranges can result
| in corrupted values being used for memory allocation and loop
| bounds. When processing crafted diff output, these overflows may
| cause the application to allocate insufficient memory and
| subsequently perform out‑of‑bounds writes during internal
| processing.  An attacker who can control the output of the diff
| program used by diff3 (e.g. via --diff-program pointing to a
| malicious script) can trigger out-of-bounds writes, resulting in a
| crash and potentially remote code execution depending on the
| environment.   This issue has been fixed in commit
| 9ff04d5b84743e331e80b589335a52c5480d1815


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53910
https://www.cve.org/CVERecord?id=CVE-2026-53910
[1] https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
[2] https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore



----- End forwarded message -----
#1142675#18
Date:
2026-07-24 14:17:40 UTC
From:
To:
Santiago Vila <sanvila@debian.org> writes:

Do note that the CVE text is highly exaggerated, as many are:

    An attacker who can control the output of the diff program used by
    diff3 (e.g. via --diff-program pointing to a malicious script) can
    trigger out-of-bounds writes, resulting in a crash and potentially
    remote code execution depending on the environment.

If an "attacker" has access to write a malicious script on your local
environment and give them the ability to execute it, surely you have
larger problems than out-of-bounds writes in 'diff'...

Collin
#1142675#23
Date:
2026-07-24 19:58:18 UTC
From:
To:
Hi Santiago, hi Collin,

Sorry indeed, I will mark the CVE as 'unimportant' with a negligible
security impact in the security-tracker, Santiago feel free to
downgrade the severity and then just mark it as fixed once you have a
version which includes the fixes. No strict need to do an update in
stable (or if you do then via a point release).

Regards,
Salvatore
#1142675#28
Date:
2026-07-25 11:36:56 UTC
From:
To:
severity 1142675 normal
tags 1142675 - security
thanks

Based on the comments from upstream I'm going to consider this as a normal bug.

Thanks.