CVE-2026-56288 NULL Pointer Dereference in GNU patch

Medium 4.6 Published 9 Jul 2026 Updated 9 Jul 2026

An attacker can cause a denial of service in GNU patch by providing a specially crafted unified-diff file that triggers a NULL pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-56288?

CVE-2026-56288 is a medium-severity vulnerability in GNU patch, published on 9 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.

This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Weakness: CWE-476

Which versions are affected by CVE-2026-56288?

It affects 1 product.

Linux distribution packages (1)

patch Red Hat:hummingbird:1 All versions 0:2.8-4.3.hum1

Products include Gnu Patch.

How do I fix CVE-2026-56288?

Apply the vendor's patch.

Is CVE-2026-56288 being exploited?

There is no known exploitation of CVE-2026-56288 in the wild and no public exploit code.

Sources

Also known as AZL-92154, DEBIAN-CVE-2026-56288, ECHO-4701-db72-1af3, GHSA-m3j2-9m66-r96h, JLSEC-2026-1260, RHSA-2026:38019 and 1 more.