CVE-2026-6390

MediumCVSS 6.8

Published: 23/07/2026(UTC)Updated: 01/09/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

A format string vulnerability was found in GNU nano's multi-buffer error message handling. A specially crafted filename with printf format specifiers can lead to stack information disclosure, denial of service, or arbitrary memory writes.

Risk Assessment

An attacker could remotely leak sensitive data, crash the editor, or gain control over the nano process, compromising system security.

Recommendation

Update GNU nano to a patched version (e.g., 8.3 or later) immediately.

Other vulnerabilities in GNU nano

CVE-2024-5742Low
A vulnerability in GNU Nano allows privilege escalation through an insecure temporary file. If Nano is killed while editing, it saves an emergency file with the permissions of the running user.

Original NVD description (English source)

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS