CVE-2026-56288

Publication date 9 July 2026

Last updated 16 July 2026

Ubuntu priority

Cvss 3 Severity Score

Description

GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313

Read the notes from the security team

Why is this CVE low priority?

Only a crash in a command line tool

Learn more about Ubuntu priority

Status

Show unmaintained releases

Package	Ubuntu Release	Status
patch	26.04 LTS resolute	Not affected
	25.10 questing	Ignored end of life, was needs-triage
	24.04 LTS noble	Vulnerable
	22.04 LTS jammy	Vulnerable
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Vulnerable
	14.04 LTS trusty	Vulnerable

Notes

mdeslaur

This is a crash in a command line tool with little security impact, marking priority as low

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
patch	Upstream: ?id=e6d

Severity score breakdown

CVSS version:

Base score 4.6 · Medium

Base metrics

Parameter	Value
Attack vector	Local
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	Active
Vulnerable system - Confidentiality impact	None
Vulnerable system - Integrity impact	None
Vulnerable system - Availability impact	Low
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	4.6 · Medium
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Base score 5.5 · Medium