# CVE-2026-56288: GNU patch NULL pointer dereference in unified-diff processing

Source: https://junglewise.ai/threats/cve-2026-56288-gnu-patch-null-pointer-dereference-in-unified-diff-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-56288 · Severity: info · CVSS 4.6 · Published 2026-07-09

GNU patch is a standard utility used to apply code changes (diffs) to files. A vulnerability exists where a specially crafted patch file can cause the utility to crash. This could disrupt automated software build processes or development workflows if a user or system attempts to process a malicious file.

Technologies: [Gnu Patch](https://junglewise.ai/threats/technologies/patch). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-56288 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56288 being exploited in the wild.

**How severe is CVE-2026-56288?** Informational severity, with a CVSS score of 4.6, published 9 July 2026.

**Which products and versions are affected?** Gnu Patch All through 2.8.0.

**Is there a fix for CVE-2026-56288?** A patch was published on 2026-04-21: Commit date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56288 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-56288?** Check whether you run Gnu Patch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in GNU patch through version 2.8.0. The issue is caused by improper handling of consecutive end-of-file newline markers within unified-diff input, which leads to the corruption of internal hunk data structures. When the application subsequently attempts to process these structures, it passes a NULL pointer to the fwrite() function. An attacker can exploit this by providing a malicious patch file, requiring user interaction to trigger the utility, resulting in an application crash (Denial of Service). A fix is available in commit e6d6a4e021660679d7fc9150f981d4920f722313.

## Affected products

- GNU patch All through 2.8.0

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: advisory
- 2026-04-21: patched: Commit date for the fix

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-56288](https://cert.pl/en/posts/2026/07/CVE-2026-56288)
- [https://cgit.git.savannah.gnu.org/cgit/patch.git/](https://cgit.git.savannah.gnu.org/cgit/patch.git/)
- [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313](https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313)

## Related threats

- [GNU patch arbitrary file creation via path traversal](https://junglewise.ai/threats/cve-2026-115207-a-flaw-was-found-in-gnu-patch-an-attacker-can-achieve-arbitrary)
- [GNU patch infinite loop in unified-diff hunk processing](https://junglewise.ai/threats/cve-2026-56289-gnu-patch-infinite-loop-in-unified-diff-hunk-processing)