GNU diffutils CVE-2026-53910

Exploitation requires the attacker to control the diff program executed by diff3, which is achievable via the --diff-program command-line flag pointing to a malicious or attacker-controlled script. This means the attacker must either: (1) have local access to invoke diff3 directly with arbitrary flags, (2) control or inject into a script or configuration that invokes diff3 with the --diff-program option, or (3) be in a position to influence the build/merge environment where diff3 is called automatically. The CVSS 4.0 AT:P (attack requirements present) metric confirms specific preconditions must be met. Exploitation is limited by the requirement that the victim environment actually uses diff3 with a user-configurable or attacker-influenced --diff-program path. Environments that invoke diff3 with hardcoded, trusted diff-program paths, or that do not use diff3 at all, are not exposed. No special network access or authentication is required once --diff-program control is obtained, but that control itself is the principal barrier.

The CVSS 4.0 base score of 2.1 (AV:L/AC:L/AT:P/PR:N/UI:N) reflects specific attack requirements (AT:P) that substantially limit real-world risk. Exploitation requires an attacker-controlled diff program to be set via --diff-program - a condition that implies either local shell access, social engineering of a developer/CI pipeline operator, or prior compromise of a build script. Confidentiality impact is scored VC:N even though RCE is described as a possibility; the vendor and scorer appear to treat full code execution as conditional on environment, opting for the more conservative VI:L/VA:L impact. No EPSS data was provided in the input, and no CISA KEV listing exists, meaning there is no known active exploitation. The subsequent-system impacts (SC:L/SI:L/SA:L in the provided CVSS 4.0 vector) suggest the scorer recognized risk to downstream systems such as CI/CD pipelines or automated merge tooling where diff3 may run with elevated pipeline privileges. The gap between 'potential RCE' in the description and the low CVSS score is notable: if the attacker can already set --diff-program to an arbitrary script, they may achieve equivalent impact through that script directly, making the heap overflow a secondary concern. Real priority is LOW for most environments, MEDIUM in automated build/merge pipelines where diff3 is invoked with user-controlled inputs.

A threat actor with write access to a CI/CD pipeline configuration modifies a build script to invoke diff3 with --diff-program pointing to an attacker-supplied shell script; the script outputs specially crafted diff content designed to trigger signed integer overflow in diff3's line-mapping arithmetic, causing an undersized heap allocation and subsequent out-of-bounds write. Depending on heap layout and the environment's exploit mitigations, this could result in a crash that disrupts the build pipeline or, in environments with weak ASLR or no stack canaries, could be developed into code execution running as the pipeline service account. No public proof-of-concept exploit code was identified in the provided intelligence.