NULL Pointer Dereference Vulnerability in GNU Patch Package
Summary
DEBIAN-CVE-2026-56288: GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Affects patch versions 2.7.6-7 – 2.8-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Patch is a widely used utility in Unix-like operating systems that allows users to apply changes to files based on differences specified in a patch file. It is essential for managing source code changes and collaborative development. However, a recent vulnerability has been identified that affects its stability and security, specifically when processing certain types of patch files.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference that occurs when GNU Patch processes a specially crafted unified-diff patch file. This issue is triggered by improper handling of consecutive end-of-file newline markers, which can corrupt internal data structures. As a result, the application may attempt to write to a NULL pointer during patch processing, leading to a crash and a denial of service. Attackers can exploit this vulnerability by crafting malicious patch files, potentially disrupting services that rely on the patch utility.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or malicious patch files until they have updated to the patched version of GNU Patch. It is advisable to validate patch files before applying them to prevent potential crashes.
Conclusion
The NULL pointer dereference vulnerability in the GNU Patch package poses a significant risk, leading to potential denial of service through crafted patch files. Users are strongly encouraged to update their packages to the latest version to mitigate this risk and ensure the stability of their systems.
See every vulnerability recorded for patch →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability affects the GNU Patch package across various Debian distributions, including Debian 11 (Bullseye), Debian 12 (Bookworm), Debian 13 (Trixie), and Debian 14 (Forky).
If an immediate update is not possible, refrain from using untrusted patch files and validate any patch files before applying them to mitigate the risk of exploitation.
More information can be found in the official vulnerability database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56288.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
