Skip to content
OpenAdvisories
Low USN-8692-1 1 CVE

diffutils vulnerability

Published Aug 31, 2026 · Updated Aug 31, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GNU diffutils incorrectly handled certain integer
arithmetic when mapping line ranges in diff3. A local attacker could
possibly use this issue to cause diff3 to crash, resulting in a denial of
service.

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS diffutils 1:3.8-0ubuntu2.1
Ubuntu · 24.04 LTS 24.04:LTS diffutils 1:3.10-1ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS diffutils 1:3.12-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS diffutils 1:3.3-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS diffutils 1:3.3-3ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS diffutils 1:3.6-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS diffutils 1:3.7-3ubuntu0.1~esm1

Vulnerabilities 1

  • Low 2.1
    CVE-2026-53910

    Heap-based Buffer Overflow in GNU diffutils

    diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and …

    GNU diffutils diffutils diffutils Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-53910