CVE-2026-56288: NULL Pointer Dereference in GNU patch
GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.6-10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e6d6a4e021660679d7fc9150f981d4920f722313
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56288?
CVE-2026-56288 has a medium severity rating of 4.6.
How do I fix CVE-2026-56288?
To fix CVE-2026-56288, update to the latest version of GNU patch that addresses this vulnerability.
What type of vulnerability is CVE-2026-56288?
CVE-2026-56288 is classified as a NULL pointer dereference vulnerability.
What can be affected by CVE-2026-56288?
CVE-2026-56288 specifically affects the GNU patch software when processing malformed unified-diff patch files.
What are the implications of CVE-2026-56288?
The implications of CVE-2026-56288 include potential application crashes and corruption of internal data structures.