{"id":"CVE-2026-56288","summary":"NULL Pointer Dereference in GNU patch","details":"GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.\nAn attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.\n\n\n\nThis issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313","modified":"2026-10-27T02:47:30.573250522Z","published":"2026-07-09T09:29:07.947Z","related":["SUSE-SU-2026:22604-1","SUSE-SU-2026:22651-1","SUSE-SU-2026:22905-1","SUSE-SU-2026:23210-1","SUSE-SU-2026:2922-1","SUSE-SU-2026:3161-1","openSUSE-SU-2026:11260-1","openSUSE-SU-2026:21332-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"last_affected":"2.8.0"}]}]}],"cna_assigner":"CERT-PL","cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56288.json"},"references":[{"type":"WEB","url":"https://cgit.git.savannah.gnu.org/cgit/patch.git/"},{"type":"ADVISORY","url":"https://cert.pl/en/posts/2026/07/CVE-2026-56288"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56288.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56288"},{"type":"FIX","url":"https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://cgit.git.savannah.gnu.org/cgit/patch.git","events":[{"introduced":"0"},{"fixed":"e6d6a4e021660679d7fc9150f981d4920f722313"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"e6d6a4e021660679d7fc9150f981d4920f722313"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56288.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}