CVE catalog

CVE-2026-56288

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hun

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpatchsid2.8.1-1vulnerable
Debianpatchforky2.8.1-1vulnerable
Debianpatchtrixie2.8-2vulnerable
Debianpatchbookworm2.7.6-7vulnerable
CpepatchNot reportedNot reportedvulnerable
Susepatchlinux enterprise module for basesystem 15 sp72.7.6-150000.5.12.1fixed
Susepatchlinux enterprise server 16.02.7.6-160000.4.1fixed
Susepatchlinux enterprise server for sap applications 16.02.7.6-160000.4.1fixed
Susepatchlinux micro 6.22.7.6-160000.4.1fixed
Opensusepatchleap 16.02.7.6-160000.4.1fixed
Opensusepatchtumbleweed2.8-3.1fixed
CpepatchNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpatchsourcesid(unfixed)unimportantNot reportedNot reported
Debianpatchsourceforky(unfixed)unimportantNot reportedNot reported
Debianpatchsourcetrixie(unfixed)unimportantNot reportedNot reported
Debianpatchsourcebookworm(unfixed)unimportantNot reportedNot reported
Susepatchrpmlinux enterprise module for basesystem 15 sp72.7.6-150000.5.12.1Not reportedSUSE-SU-2026:3161-1Not reported
Susepatchrpmlinux enterprise server 16.02.7.6-160000.4.1Not reportedSUSE-SU-2026:22651-1Not reported
Susepatchrpmlinux enterprise server for sap applications 16.02.7.6-160000.4.1Not reportedSUSE-SU-2026:22651-1Not reported
Susepatchrpmlinux micro 6.22.7.6-160000.4.1Not reportedSUSE-SU-2026:22604-1Not reported
Opensusepatchrpmleap 16.02.7.6-160000.4.1Not reportedOPENSUSE-SU-2026:21332-1Not reported
Opensusepatchrpmtumbleweed2.8-3.1Not reportedOPENSUSE-SU-2026:11260-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [patch]Affected
    Details (2)

    • 2.7.6-7 · amd64 · bookworm

      Affected

      nvd · patch · debian · bookworm; nvd · patch · debian · 12

    • 2.7.6-7 · arm64 · bookworm

      Affected

      nvd · patch · debian · bookworm; nvd · patch · debian · 12

[Debian 13 (Trixie)]

  • [patch]Affected
    Details (2)

    • 2.8-2 · amd64 · trixie

      Affected

      nvd · patch · debian · 13

    • 2.8-2 · arm64 · trixie

      Affected

      nvd · patch · debian · 13

[openSUSE Tumbleweed]

  • [patch]Fixed

    Source package: [patch]

    Details (1)

    • 2.8-3.2 · x86_64 · tumbleweed

      Fixed · Fixed: 2.8-3.1

      nvd · patch · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]