Quick answers
- Is CVE-2026-56288 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56288 being exploited in the wild.
- How severe is CVE-2026-56288?
- Informational severity, with a CVSS score of 4.6, published 9 July 2026.
- Which products and versions are affected?
- Gnu Patch All through 2.8.0.
- Is there a fix for CVE-2026-56288?
- A patch was published on 2026-04-21: Commit date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-56288 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-56288?
- Check whether you run Gnu Patch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in GNU patch through version 2.8.0. The issue is caused by improper handling of consecutive end-of-file newline markers within unified-diff input, which leads to the corruption of internal hunk data structures. When the application subsequently attempts to process these structures, it passes a NULL pointer to the fwrite() function. An attacker can exploit this by providing a malicious patch file, requiring user interaction to trigger the utility, resulting in an application crash (Denial of Service). A fix is available in commit e6d6a4e021660679d7fc9150f981d4920f722313.
Affected products
- GNU patch All through 2.8.0
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
- 2026-04-21: patched: Commit date for the fix