CVE-2026-53910 describes a vulnerability in the diff3 tool of GNU diffutils where multiple signed integer overflows occur during line-mapping calculations. This results in corrupted values used for memory allocation and loop bounds, causing heap-based buffer overflows. When diff3 processes specially crafted diff output—particularly if the diff program is controlled by an attacker via the --diff-program option—these overflows can lead to out-of-bounds writes. This may cause application crashes or potentially remote code execution depending on the environment. The vulnerability is tracked as CWE-190 (Integer Overflow or Wraparound) and has been addressed in commit 9ff04d5b84743e331e80b589335a52c5480d1815, though no official patch release details are provided.

The vulnerability allows an attacker who can influence the diff output used by diff3 to cause heap-based buffer overflows. This can lead to application crashes and, depending on the environment, remote code execution. The CVSS 4.0 score is low (2.1), reflecting limited attack vector and complexity, but the impact includes potential privilege escalation or code execution if exploited.

The issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815. However, no official patch or fixed version is explicitly stated in the provided data. Patch status is not yet confirmed—check the GNU diffutils vendor advisory or official repositories for current remediation guidance. Until a fixed version is applied, avoid using untrusted diff output with diff3, especially when using the --diff-program option to specify external diff programs.