Skip to main content

GNU patch CVE-2026-56288

| EUVDEUVD-2026-42556 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-09 CERT-PL GHSA-m3j2-9m66-r96h
Denial Of Service Null Pointer Dereference Red Hat Patch Suse Gnu
4.6
CVSS 4.0 · Vendor: CERT-PL
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft unified-diff with malformed EOF newline markers
  2. Delivery
    Deliver malicious file to target user or pipeline
  3. Exploit
    User invokes GNU patch against crafted file
  4. Execution
    Consecutive EOF markers corrupt hunk data structures
  5. Persist
    NULL pointer passed to fwrite()
  6. Impact
    patch process crashes (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The victim must actively invoke the GNU patch utility and supply the crafted unified-diff file as input - confirmed by CVSS UI:A (active user interaction required). The attack vector is local (AV:L), meaning the attacker cannot exploit this remotely without first delivering the malicious file through a separate channel (email, repository, download). No elevated privileges are required (PR:N); any user account capable of running patch suffices. No special system configuration is needed beyond having a vulnerable version of GNU patch installed. Exploitation is limited by the necessity of social engineering or supply-chain delivery of the malicious patch file; automated CI/CD systems that blindly apply externally sourced diff files represent the primary elevated-risk scenario. The impact is strictly a crash of the patch process (VA:L) - no confidentiality or integrity exposure is indicated.
Impact

The CVSS 4.0 score of 4.6 with vector AV:L/AC:L/AT:N/PR:N/UI:A/VA:L accurately reflects the constrained threat model: exploitation is local, requires user interaction, and yields only a limited availability impact (crash of the patch process, not system-wide disruption). No EPSS data was provided in the intelligence package, and no CISA KEV listing exists, indicating no confirmed active exploitation. No public proof-of-concept exploit is known at time of analysis. The practical risk is low: an attacker must socially engineer a developer or sysadmin into applying a malicious patch file. Automated pipelines that ingest untrusted patch files without validation represent the highest-risk deployment scenario. This is not a high-priority emergency patch but is worth tracking for environments where untrusted diff files are processed.
Exploit ScenarioDerived

An attacker crafts a unified-diff file containing specially structured consecutive end-of-file newline markers and delivers it to a developer or sysadmin - for example, as a malicious patch submission to an open-source project or via a compromised repository. When the victim runs the patch command against this file, the corrupted hunk data structure causes a NULL pointer dereference in fwrite(), crashing the utility and potentially disrupting automated patch-application workflows.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 09, 2026

GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting in denial of service. Improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures, causing a NULL pointer to be passed to fwrite() during processing. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is constrained by the requirement for user interaction with a malicious file.

RemediationAI

The upstream fix is available as commit e6d6a4e021660679d7fc9150f981d4920f722313 in the GNU patch Savannah repository (https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313); a formal tagged release version has not been independently confirmed, so this is an upstream commit fix pending a versioned release. Users should monitor their Linux distribution's package tracker for an updated gnu-patch or patch package and apply it when available. As an immediate compensating control, restrict the use of the patch utility to patch files sourced from trusted, verified origins - specifically, disable or audit any automated pipeline or CI/CD step that applies externally supplied diff files without validation. This mitigation has the trade-off of blocking legitimate patch workflows from external contributors until the fix is distributed. Refer to CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-56288 for additional guidance.

Affected VersionsENISA

Patch 0 ≤2.8.0

Affected Packages

euvd patch no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GNU patch (CPE: cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:*) is a ubiquitous Unix utility for applying unified-diff files to source trees. The root cause is CWE-476 (NULL Pointer Dereference): when parsing unified-diff format, the utility tracks change blocks called hunks using internal data structures. Consecutive end-of-file newline markers are not properly validated, leading to heap or stack corruption of these hunk structures. The corrupted pointer is subsequently passed unchecked to fwrite() during patch output processing, causing an immediate application crash. The CVSS 4.0 vector AV:L/UI:A confirms the local, user-initiated attack surface - the crafted file must be actively fed to the patch command.

Know when Patch gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CERT-PL) PRIMARY 4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
vuln.today AI 3.3 LOW

Local attack requiring active user invocation of patch against a malicious file (UI:R); no privileges needed; impact is solely a process crash with no confidentiality or integrity exposure (A:L only).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 3.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat 5.0 MEDIUM

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
High
ships with virtually all Linux and Unix distributions
Social Media
2
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

23
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +23
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Patch

View all
CVE-2021-45261 MEDIUM POC
5.5 Dec 22

An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service
CVE-2015-1196 MEDIUM POC
4.3 Jan 21

GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. Rated medium s
CVE-2015-1395 HIGH
7.5 Aug 25

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote atta
CVE-2019-13638 HIGH
7.8 Jul 26

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fil
CVE-2018-1000156 HIGH
7.8 Apr 06

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_
CVE-2018-6952 HIGH
7.5 Feb 13

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), t
CVE-2018-6951 HIGH
7.5 Feb 13

An issue was discovered in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2025-15337 MEDIUM
6.5 Feb 05

Tanium addressed an incorrect default permissions vulnerability in Patch. [CVSS 6.5 MEDIUM]
CVE-2026-11391 MEDIUM
6.3 Jul 28

SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the back
CVE-2019-13636 MEDIUM
5.9 Jul 17

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. Rated mediu
CVE-2014-9637 MEDIUM
5.5 Aug 25

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fa
CVE-2026-56289 MEDIUM
4.6 Jul 09

GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an exce

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:latest Container bci/spack:latest Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
SUSE Linux Micro 6.2 Fixed

References

Advisories & patches
PATCH https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313 ADVISORY https://access.redhat.com/errata/RHSA-2026:38019 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56288 ADVISORY https://vuldb.com/vuln/377174 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22604/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22651/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2922/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3161/ REF https://cert.pl/en/posts/2026/07/CVE-2026-56288 REF https://cgit.git.savannah.gnu.org/cgit/patch.git/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy