OESA-2026-4618: patch security update

Q: Who is exposed to this issue?

Users or automated workflows that apply untrusted or attacker-controlled patch files with GNU patch are exposed. Successful exploitation creates files with the permissions of the user or process running patch.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs to entice a user or automated workflow to apply a specially crafted patch file. The patch relies on absolute file paths in patch headers being accepted during automatic patch reversal.

Q: Is user interaction required?

Yes. The provided severity vector indicates user interaction is required, and the issue requires a user or automated workflow to apply the crafted patch.

Q: What is the impact if exploitation succeeds?

An attacker can create files outside the intended working directory, including at arbitrary filesystem locations that the executing user is permitted to write. The reported impact is integrity loss; no confidentiality or availability impact is indicated.

Published Oct 29, 2026

Updated

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fix(es):

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)

Affected Software

1 affected componentFixes available

openeuler/patch<2.7.6-24.oe2403sp1

2.7.6-24.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/patch to a version that resolves this vulnerability.
Fixed in 2.7.6-24.oe2403sp1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115207

Frequently Asked Questions

Who is exposed to this issue?

Users or automated workflows that apply untrusted or attacker-controlled patch files with GNU patch are exposed. Successful exploitation creates files with the permissions of the user or process running patch.

What does an attacker need to exploit the vulnerability?

The attacker needs to entice a user or automated workflow to apply a specially crafted patch file. The patch relies on absolute file paths in patch headers being accepted during automatic patch reversal.

Is user interaction required?

Yes. The provided severity vector indicates user interaction is required, and the issue requires a user or automated workflow to apply the crafted patch.

What is the impact if exploitation succeeds?

An attacker can create files outside the intended working directory, including at arbitrary filesystem locations that the executing user is permitted to write. The reported impact is integrity loss; no confidentiality or availability impact is indicated.

OESA-2026-4618: patch security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is user interaction required?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is user interaction required?

What is the impact if exploitation succeeds?