GNU Coreutils & Diffutils: Three Vulnerabilities Disclosed in Early July 2026

Key findings

• Three vulnerabilities in GNU coreutils and diffutils disclosed between July 23-25, 2026.
• CVE-2026-56391: Out-of-bounds read in uniq due to multibyte input handling.
• CVE-2026-56392: Denial of Service in unexpand via crafted tab stops.
• CVE-2026-53910: Heap-based buffer overflow in diff3 from integer overflows.
• Vulnerabilities affect core command-line utilities, requiring timely updates.

On July 25, 2026, a batch of three vulnerabilities affecting GNU coreutils and GNU diffutils was disclosed, spanning a two-day period from July 23 to July 25. These vulnerabilities, identified as CVE-2026-56391, CVE-2026-56392, and CVE-2026-53910, highlight potential security risks in widely used command-line utilities.

The disclosed vulnerabilities fall into two main categories: out-of-bounds reads and heap-based buffer overflows, stemming from improper handling of input and arithmetic calculations.

CVE-2026-56391, affecting the uniq command in GNU coreutils, is an out-of-bounds read vulnerability. This occurs due to incorrect handling of multibyte input when the -w or --check-chars option is used. The find_field() function miscalculates character byte lengths by repeatedly processing a fixed pointer instead of advancing through the input, leading to an integer overflow.

CVE-2026-56392, also related to GNU coreutils, is a moderate severity denial-of-service vulnerability in the unexpand utility. This flaw is triggered by crafted tab stop values, allowing an attacker to disrupt the service.

The third vulnerability, CVE-2026-53910, impacts the diff3 tool within GNU diffutils. It is a heap-based buffer overflow vulnerability caused by multiple signed integer overflows in line-mapping calculations. Errors in arithmetic for mapping line ranges can lead to corrupted values used for memory allocation and loop bounds, potentially causing a crash when processing crafted diff output.

While the provided information does not detail specific exploitation in the wild or active campaigns, the nature of these vulnerabilities suggests potential risks for systems processing untrusted input through these utilities. Users are advised to update their coreutils and diffutils packages to the latest versions to mitigate these risks. The exact patched versions are not specified in the provided details, but it is standard practice for vendors to release security updates addressing such issues.

This batch of vulnerabilities underscores the importance of maintaining up-to-date systems, even for fundamental command-line tools. Users of Debian and other systems relying on GNU coreutils and diffutils should prioritize applying any available security patches to prevent potential disruptions or security compromises. Further details and specific patch information can typically be found in the official advisories from GNU and distribution maintainers.