CVE-2026-56288
published 2026-07-09CVE-2026-56288: GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.17%
6.4th percentile
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | patch | <= 2.8.0 | — |
| gnu | patch | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.04.6MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU patch up to 2.8.0 Hunk fwrite null pointer dereference (Nessus ID 326081)
vuldb·2026-07-13·CVSS 5.5
CVE-2026-56288 [MEDIUM] GNU patch up to 2.8.0 Hunk fwrite null pointer dereference (Nessus ID 326081)
A vulnerability classified as problematic has been found in GNU patch up to 2.8.0. Impacted is the function fwrite of the component Hunk Handler. This manipulation causes null pointer dereference.
This vulnerability appears as CVE-2026-56288. The attack may be initiated remotely. There is no available exploit.
GHSA
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file.
ghsa_unreviewed·2026-07-09
CVE-2026-56288 [MEDIUM] CWE-476 GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file.
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313
Red Hat
patch: GNU patch: Denial of Service via specially crafted patch file
vendor_redhat·2026-07-09·CVSS 5.5
CVE-2026-56288 [MEDIUM] CWE-476 patch: GNU patch: Denial of Service via specially crafted patch file
patch: GNU patch: Denial of Service via specially crafted patch file
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313
A flaw was found in GNU patch. An attacker can exploit this by providing a specially crafted patch file, which leads to a NULL pointer dereference. This improper handling of en
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-09
Published