CVE-2019-20633: GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.

mediumCVSS 5.5CVE-2019-20633

CSIRTS triage

vendor: GNU product: patch Denial of service Memory corruptionaffected: through 2.7.6

What: A double-free vulnerability in the another_hunk function allows denial of service when processing a crafted patch file.
Who is affected: GNU patch through version 2.7.6 is affected.
Urgency: Remediation is routine; CVSS 5.5 is moderate and no active exploitation reported.
Action: Upgrade GNU patch to a version after 2.7.6 that includes the fix.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch patch

Get an email when a new patch advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: medium — CVSS 5.5
Published: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-20633

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2019-206331.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2019-20633	coverage & exploitation status	NVD · CVE.org

Recent advisories for GNU patch

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-56289: Loop with Unreachable Exit Condition in GNU patchmsrc · 2026-07-14
unknownCVE-2026-56288: NULL Pointer Dereference in GNU patchmsrc · 2026-07-14
mediumCVE-2026-56289: GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (singl…nvd · 2026-07-09
mediumCVE-2026-56288: GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unif…nvd · 2026-07-09