CVE-2026-56288

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert.pl/en/posts/2026/07/CVE-2026-56288	Third Party Advisory
https://cgit.git.savannah.gnu.org/cgit/patch.git/	Patch Product
https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) GNU patch es vulnerable a una desreferencia de puntero NULL al procesar un archivo de parche unified-diff especialmente diseñado. El manejo inadecuado de los marcadores de nueva línea consecutivos de fin de archivo puede corromper las estructuras de datos internas de hunk (bloque único de cambios en diff), haciendo que la aplicación pase un puntero NULL a fwrite() durante el procesamiento del parche. Un atacante puede desencadenar esta condición con un archivo de parche malicioso, haciendo que la utilidad falle y resultando en una denegación de servicio. Este problema ha sido solucionado en el commit e6d6a4e021660679d7fc9150f981d4920f722313

Information

Published : 2026-07-09 11:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-56288

Mitre link : CVE-2026-56288

CVE.ORG link : CVE-2026-56288

JSON object : View

Products Affected

gnu

patch

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-56288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56288", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T12:57:28.554596Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://cgit.git.savannah.gnu.org/cgit/patch.git/", "vendor": "GNU", "product": "patch", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.8.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-09T11:16:40.713", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-56288", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cgit.git.savannah.gnu.org/cgit/patch.git/", "tags": ["Patch", "Product"], "source": "cvd@cert.pl"}, {"url": "https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313", "tags": ["Patch"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.\nAn attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.\n\n\n\nThis issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313"}, {"lang": "es", "value": "GNU patch es vulnerable a una desreferencia de puntero NULL al procesar un archivo de parche unified-diff especialmente dise\u00f1ado. El manejo inadecuado de los marcadores de nueva l\u00ednea consecutivos de fin de archivo puede corromper las estructuras de datos internas de hunk (bloque \u00fanico de cambios en diff), haciendo que la aplicaci\u00f3n pase un puntero NULL a fwrite() durante el procesamiento del parche.\nUn atacante puede desencadenar esta condici\u00f3n con un archivo de parche malicioso, haciendo que la utilidad falle y resultando en una denegaci\u00f3n de servicio.\n\nEste problema ha sido solucionado en el commit e6d6a4e021660679d7fc9150f981d4920f722313"}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA5579D9-02DF-477D-A4A6-C4BF63EE1ADB", "versionEndIncluding": "2.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}