GNU patch contains a loop that can become effectively infinite when processing a hunk that references a line number beyond the length of the target file. A patch file crafted with an extremely large offset forces the utility to repeatedly attempt to locate a non‑existent position, consuming CPU until the process is stopped. The flaw lies in improper validation of hunk line offsets and is identified as CWE‑835. Although the attack causes a resource exhaustion denial of service, it does not provide code execution or privilege escalation.

All releases of the GNU patch utility prior to commit faba04ef4f2b410257f76c1b9dc85e350929c4b9 are affected. The fix is included in that commit, so any build that does not incorporate this change remains vulnerable.

The CVSS score of 4.6 signals moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalogue. An attacker would need to supply a malicious patch file to the target system, which limits the impact to environments that automatically ingest or apply patches. Once the malicious patch is processed, the process becomes unresponsive without requiring elevated privileges, providing a resource‑exhaustion denial of service.