Executive brief
GNU patch is a standard utility used to apply code changes to files. A vulnerability exists where a maliciously crafted patch file can cause the utility to enter an infinite loop, consuming all available processor power. This results in a denial of service, making the system unresponsive or preventing software updates from completing until the process is manually terminated.
Technical details
GNU patch (through version 2.8.0) contains a Loop with Unreachable Exit Condition (CWE-835) when processing unified-diff input. The vulnerability is rooted in improper validation of hunk line offsets; a specially crafted patch file can specify an extremely large line number, causing the application to enter an infinite loop while attempting to locate the requested position. This results in 100% CPU utilization and process hang. Exploitation requires a user to attempt to apply the malicious patch file locally. The issue has been addressed in commit faba04ef4f2b410257f76c1b9dc85e350929c4b9.
Affected products
- GNU patch All through 2.8.0
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
- 2026-04-21: patched: Date of fix commit by Paul Eggert