CVE-2026-53910 is a heap-based buffer overflow vulnerability in the diff3 program of the diffutils package due to multiple signed integer overflows in line-mapping calculations. Incorrect arithmetic can corrupt values used for memory allocation and loop bounds, leading to denial of service or memory corruption. Exploitation requires an attacker to control the diff output used by diff3 or trick a user into executing diff3 with crafted input, typically requiring prior execution privileges. Red Hat has issued an update for diffutils-3.12-6.1.hum1 in Red Hat Hardened Images to address this issue.

The vulnerability can cause denial of service through crashes or memory corruption. It may also lead to data corruption or potentially arbitrary code execution if exploited. However, exploitation complexity is relatively high since the attacker needs to control diff output or convince a user to run diff3 with malicious input, and usually must already have execution privileges on the system. Red Hat rates the severity as low.

Red Hat has released an update for diffutils-3.12-6.1.hum1 in Red Hat Hardened Images that addresses this vulnerability. Users should apply this update to remediate the issue. Additionally, avoid running diff3 with untrusted input for the --diff-program argument or processing untrusted diff output to mitigate risk.