Every CVE Search/ Get API key

CVE-2026-56288

NULL Pointer Dereference in GNU patch

4.6 MediumFix available

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.11%Unchanged since Jul 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.6

NULL Pointer Dereference in GNU patch

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
CVE-2026-56288
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-42556 4.6

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
EUVD-2026-42556
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m3j2-9m66-r96h 4.6

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified...

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
GHSA-m3j2-9m66-r96h
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 4.6

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
CVE-2026-56288
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2026-56288 5.5

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
ALPINE-CVE-2026-56288
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVBELL-CVE-2026-56288 5.5
Record
BELL-CVE-2026-56288
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 18 moreShow less
OSV 4.6

NULL Pointer Dereference in GNU patch

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
CVE-2026-56288
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56288 5.5

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
DEBIAN-CVE-2026-56288
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-1260 4.6

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified...

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
JLSEC-2026-1260
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3056 4.6

patch security update

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.

Security Fix(es):

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313(CVE-2026-56288)

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.

This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9(CVE-2026-56289)

Record
OESA-2026-3056
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVRHSA-2026:38019 5.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38019
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56288 4.6

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
UBUNTU-CVE-2026-56288
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-92154 No score

CVE-2026-56288 affecting package patch for versions less than 2.7.6-10

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Record
AZL-92154
Updated
2026-11-05
OSVCLSA-2026-1784218870 No score

patch: Fix of 2 CVEs

  • CVE-2026-56288: NULL pointer dereference via crafted unified-diff hunk (another_hunk)
  • CVE-2026-56289: Denial of service via infinite loop on null-range hunk offsets (locate_hunk)
Record
CLSA-2026-1784218870
Updated
2026-11-02
OSVCLSA-2026-1784720743 No score

patch: Fix of 2 CVEs

  • CVE-2026-56288: NULL pointer dereference via crafted unified-diff hunk (another_hunk)
  • CVE-2026-56289: Denial of service via infinite loop on null-range hunk offsets (locate_hunk)
Record
CLSA-2026-1784720743
Updated
2026-11-02
OSVMGASA-2026-0423 No score

Updated patch package fixes security vulnerabilities

NULL Pointer Dereference in GNU patch. (CVE-2026-56288) Loop with Unreachable Exit Condition in GNU patch. (CVE-2026-56289)

Record
MGASA-2026-0423
Updated
2026-11-02
OSVopenSUSE-SU-2026:11260-1 No score

patch-2.8-3.1 on GA media

These are all security issues fixed in the patch-2.8-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11260-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21332-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
openSUSE-SU-2026:21332-1
Updated
2026-11-02
OSVSUSE-SU-2026:22604-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
SUSE-SU-2026:22604-1
Updated
2026-11-02
OSVSUSE-SU-2026:22651-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
SUSE-SU-2026:22651-1
Updated
2026-11-02
OSVSUSE-SU-2026:22905-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2021-45261: Invalid Pointer via another_hunk function (bsc#1194037).
  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
SUSE-SU-2026:22905-1
Updated
2026-11-02
OSVSUSE-SU-2026:23210-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2021-45261: Invalid Pointer via another_hunk function (bsc#1194037).
  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
SUSE-SU-2026:23210-1
Updated
2026-11-02
OSVSUSE-SU-2026:2922-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2021-45261: Invalid Pointer via another_hunk function (bsc#1194037).
  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
SUSE-SU-2026:2922-1
Updated
2026-11-02
OSVSUSE-SU-2026:3161-1 No score

Security update for patch

This update for patch fixes the following issues

  • CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
  • CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
Record
SUSE-SU-2026:3161-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
patch
Alpine:v3.24
 before 2.8.1-r0
2.8.1-r0
patch
Azure Linux:3
 before 2.7.6-10
2.7.6-10
patch
Alpaquita:23
 2.7.6-r8 up to 2.7.6-r10
2.7.6-r10
patch
Alpaquita:25
 2.8-r0 up to 2.8.1-r0
2.8.1-r0
patch
Alpaquita:stream
 2.7.6-r7 up to 2.8.1-r0
2.8.1-r0
patch
BellSoft Hardened Containers:23
 2.7.6-r8 up to 2.7.6-r10
2.7.6-r10
patch
BellSoft Hardened Containers:25
 2.8-r0 up to 2.8.1-r0
2.8.1-r0
patch
BellSoft Hardened Containers:stream
 2.7.6-r7 up to 2.8.1-r0
2.8.1-r0
patch
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 2.7.6-16.el9_6.tuxcare.els1
2.7.6-16.el9_6.tuxcare.els1
patch
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2.7.6-16.el9_2.tuxcare.els1
2.7.6-16.el9_2.tuxcare.els1
Show 29 moreShow less
Affected packages
PackageAffectedFixed
patch
Debian:12
 All versions, plus listed versions
2.7.6-72.8-12.8-22.8.1-1
 None known
patch
Debian:13
 All versions, plus listed versions
2.8-22.8.1-1
 None known
patch
Debian:14
 All versions, plus listed versions
2.8-22.8.1-1
 None known
patch_jll
Julia
 All versions None known
patch
Mageia:10
From an advisory covering 2 CVEs
 before 2.8-1.1.mga10
2.8-1.1.mga10
patch
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.7.6-23.oe2403sp3
2.7.6-23.oe2403sp3
patch
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.7.6-23.oe2403sp4
2.7.6-23.oe2403sp4
patch
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.7.6-16.oe2003sp4
2.7.6-16.oe2003sp4
patch
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.7.6-16.oe2203sp4
2.7.6-16.oe2203sp4
patch
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.7.6-23.oe2403sp1
2.7.6-23.oe2403sp1
patch
Red Hat:hummingbird:1
 before 0:2.8-4.3.hum1
0:2.8-4.3.hum1
patch
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 2.7.6-160000.4.1
2.7.6-160000.4.1
patch
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 2.7.6-160000.4.1
2.7.6-160000.4.1
patch
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 2.7.6-160000.4.1
2.7.6-160000.4.1
patch
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 2.7.6-slfo.1.1_2.1
2.7.6-slfo.1.1_2.1
patch
SUSE:Linux Micro 6.0
From an advisory covering 3 CVEs
 before 2.7.6-4.1
2.7.6-4.1
patch
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 3 CVEs
 before 2.7.5-8.14.1
2.7.5-8.14.1
patch
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.7.6-150000.5.12.1
2.7.6-150000.5.12.1
patch
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.7.1-32.7.1-42.7.1-4ubuntu12.7.1-4ubuntu22.7.1-4ubuntu2.32.7.1-4ubuntu2.42.7.1-4ubuntu2.4+esm1
 None known
patch
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7.5-12.7.5-1ubuntu0.16.04.12.7.5-1ubuntu0.16.04.2
 None known
patch
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.7.5-1build12.7.6-12.7.6-2ubuntu12.7.6-2ubuntu1.1
 None known
patch
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.7.6-6
 None known
patch
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.7.6-72.7.6-7build12.7.6-7build2
 None known
patch
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.7.6-7build22.7.6-7build3
 None known
patch
Ubuntu:25.10
 All versions, plus listed versions
2.7.6-7build32.8-12.8-2
 None known
patch
Ubuntu:26.10
 All versions, plus listed versions
2.8-2build1
 None known
patch
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.8-22.8-2build1
 None known
patch
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.8-3.1
2.8-3.1
patch
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.7.6-160000.4.1
2.7.6-160000.4.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, facts, referencesOSV
affected, aliases, products, published, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56288 is a medium vulnerability (CVSS 4.6) in Gnu Patch, published July 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in patch 2.8.1-r0.

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open