GNU patch contains a NULL pointer dereference vulnerability that is triggered when processing a specially crafted unified-diff patch file. By manipulating consecutive end‑of‑file newline markers, an attacker can corrupt internal hunk data structures and cause the utility to pass a NULL pointer to fwrite(), leading to a crash. The weakness is a classic NULL pointer dereference (CWE‑476).

The vulnerability affects the GNU patch utility distributed by the GNU project. All releases prior to the commit identified by e6d6a4e021660679d7fc9150f981d4920f722313 are susceptible. Users of older patch versions are potentially impacted.

The CVSS score of 4.6 indicates moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVE documents that an attacker must supply a specially crafted unified‑diff patch file that corrupts internal data structures, causing the utility to crash and resulting in a denial of service. The impact is limited to the process or user invoking patch. The documentation does not explicitly state whether the exploit is local or remote; this is inferred based on the fact that patch operates on local files, so a local attack is likely, though a remote attacker could trigger it if the system accepts patch files from an untrusted source. No escalation of privileges or lateral movement is described.