CVE-2026-56288
published 2026-07-09CVE-2026-56288: GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.11%
1.8th percentile
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | patch | <= 2.8.0 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.04.6MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU patch up to 2.8.0 Hunk fwrite null pointer dereference (Nessus ID 326081)
vuldb·2026-07-13·CVSS 5.5
CVE-2026-56288 [MEDIUM] GNU patch up to 2.8.0 Hunk fwrite null pointer dereference (Nessus ID 326081)
A vulnerability classified as problematic has been found in GNU patch up to 2.8.0. Impacted is the function fwrite of the component Hunk Handler. This manipulation causes null pointer dereference.
This vulnerability appears as CVE-2026-56288. The attack may be initiated remotely. There is no available exploit.
GHSA
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file.
ghsa_unreviewed·2026-07-09
CVE-2026-56288 [MEDIUM] CWE-476 GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file.
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-09
Published