CVE-2026-6390
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
29/100
Published: 2026-07-23
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Required
S:
Unchanged
C:
Low
I:
High
A:
High
Description
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
Weakness Classification (1)
References & Advisories (2)
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT