CVE-2026-6390

Summary

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-134: Use of Externally-Controlled Format String

Workarounds

Users should avoid opening untrusted files with GNU nano, especially those with filenames containing printf format specifiers (e.g., %s, %p, %n). This operational control helps prevent the exploitation of the format string vulnerability, which relies on specific filename content and error conditions during multi-buffer usage.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References