Executive brief
GNU patch is a standard utility used to apply code changes (diffs) to files. A vulnerability exists where a specially crafted patch file can cause the utility to crash. This could disrupt automated software build processes or development workflows if a user or system attempts to process a malicious file.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in GNU patch through version 2.8.0. The issue is caused by improper handling of consecutive end-of-file newline markers within unified-diff input, which leads to the corruption of internal hunk data structures. When the application subsequently attempts to process these structures, it passes a NULL pointer to the fwrite() function. An attacker can exploit this by providing a malicious patch file, requiring user interaction to trigger the utility, resulting in an application crash (Denial of Service). A fix is available in commit e6d6a4e021660679d7fc9150f981d4920f722313.
Affected products
- GNU patch All through 2.8.0
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
- 2026-04-21: patched: Commit date for the fix