CVE-2026-115207 Red Hat CVE debrief

Who should care

System administrators and users of GNU patch utility should assess exposure and prioritize patching. The vulnerability impacts system integrity and availability, and defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-115207 allows an attacker to create arbitrary files with the permissions of the executing user, potentially impacting system integrity and availability. System administrators and users of GNU patch utility should assess exposure and prioritize patching.

• Potential for unauthorized file creation
• Need for patch validation and access controls
• Possible impact on system integrity and availability

Technical summary

A flaw in GNU patch allows an attacker to create arbitrary files outside the intended working directory by exploiting missing validation during automatic patch reversal. The vulnerability is caused by accepting absolute file paths in patch headers, which allows an attacker to create files in arbitrary locations with the permissions of the executing user. System administrators and users of GNU patch utility should assess exposure and prioritize patching. The CVE record and NVD entry provide details on the flaw, allowing for arbitrary file creation.

Defensive priority

Assess exposure and prioritize patching for GNU patch utility.

Recommended defensive actions

• Review and apply patches for GNU patch utility
• Restrict access to patch files and working directories
• Monitor for suspicious file creation activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the flaw in GNU patch, allowing for arbitrary file creation. Red Hat has a reference to the CVE. The vulnerability is caused by missing validation during automatic patch reversal, which accepts absolute file paths in patch headers. This allows an attacker to create files in arbitrary locations with the permissions of the executing user. The source detail is limited, and defenders should verify the affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.