EUVD-2026-47695
GHSA-9pwr-gcwm-8wj5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity because exploitation requires controlling --diff-program flag; user interaction needed to invoke diff3; no confidentiality impact per vendor scoring.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.
This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
AnalysisAI
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Technical ContextAI
GNU diffutils provides the diff3 utility for three-way file comparison and merge, used widely in version control workflows and automated patch pipelines. The root cause is CWE-190 (Integer Overflow or Wraparound): signed integer arithmetic used for line-mapping and range calculations can overflow, yielding corrupt values that drive both memory allocation sizes and loop iteration bounds. This is a classic two-stage exploitation path - the overflow first causes an undersized heap allocation, then subsequent processing iterates over the expected (larger) range, writing beyond the allocated buffer. The affected CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:* covers all diffutils versions until the patched commits. diff3's --diff-program flag, intended to allow a custom diff binary, is the described attack surface: by substituting a malicious script, an attacker fully controls the diff output fed into the vulnerable parsing logic.
RemediationAI
The primary fix is to apply the upstream patches from the GNU diffutils Savannah repository: commit 9ff04d5b84743e331e80b589335a52c5480d1815 and commit 73ed7ce85cc78effb94daf028c9af6b4e5252e50 (https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815 and https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50). Monitor your Linux distribution's security advisories for a packaged update incorporating these commits, as no tagged upstream release version has been confirmed yet - applying a distribution-provided package is preferred over patching from source for most environments. As a compensating control where patching is not immediately possible, restrict or audit use of the --diff-program flag in automated pipelines: if diff3 is invoked via CI/CD scripts, validate that --diff-program is not user-configurable and cannot be set to attacker-controlled paths; this eliminates the primary described attack vector without disabling diff3 entirely. Note that blocking the --diff-program option removes legitimate customization capability and may break workflows relying on alternative diff implementations.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today