CVE-2026-56288

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in GNU patch via Malformed Unified Diff

Publication date: 2026-07-09

Last updated on: 2026-07-13

Assigner: CERT.PL

Description

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-09

Last Modified

2026-07-13

Generated

2026-07-16

AI Q&A

2026-07-09

EPSS Evaluated

2026-07-14

NVD

CVE-2026-56288

EUVD

EUVD-2026-42556

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	patch	to 2.8.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

CVE-2026-56288 is a vulnerability in the GNU patch software caused by improper handling of specially crafted unified-diff patch files.

Specifically, when processing patch files with consecutive end-of-file newline markers, the internal data structures representing hunks (blocks of changes) can become corrupted.

This corruption leads to the application passing a NULL pointer to the fwrite() function, which causes a NULL pointer dereference and crashes the utility.

An attacker can exploit this by providing a malicious patch file that triggers this condition.

Impact Analysis

This vulnerability can cause the GNU patch utility to crash when processing a maliciously crafted patch file.

The crash results in a denial of service (DoS), meaning legitimate patching operations can be interrupted or prevented.

If your systems or workflows rely on GNU patch for applying updates or changes, an attacker could disrupt these processes by exploiting this vulnerability.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, update GNU patch to include the fix from commit e6d6a4e021660679d7fc9150f981d4920f722313.

This commit prevents the NULL pointer dereference by ensuring that internal counters do not become negative when processing malformed patch files.

Avoid applying untrusted or specially crafted patch files that could trigger the vulnerability until the patch is applied.

Hi! I’m here to help you understand CVE-2026-56288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70