The vulnerability is a heap‑based buffer overflow in the diff3 tool of GNU diffutils, caused by multiple signed integer overflows in line‑mapping calculations. When crafted diff output or a malicious script is supplied via the --diff-program option, Diff3 performs erroneous arithmetic that results in insufficient memory allocation and subsequent out‑of‑bounds writes. This can cause the program to crash and, in certain environments, may lead to remote code execution. The weakness is a classic signed integer overflow, CWE‑190.

All versions of GNU diffutils that include the diff3 utility prior to the fix in commit 9ff04d5b84743e331e80b589335a52c5480d1815 are affected. The issue applies to the default diff3 binary supplied with the diffutils package on Linux and other Unix‑like systems.

The CVSS score of 2.1 indicates a low overall severity, and the EPSS score of < 1% indicates a very low probability of exploitation, suggesting limited publicly known exploitation activity. However, because the overflow is triggered by controlled diff output or a user‑supplied diff program, the attack vector is inferred to be input‑based or a form of command‑injection. Any system that invokes diff3 on untrusted input and allows a malicious --diff-program could, in principle, be compromised, giving attackers the potential to execute arbitrary code depending on the execution environment. Since the vulnerability is not listed in the CISA KEV catalog, it is not known to have active exploit campaigns at this time.