CVE-2026-6843

A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline() function. By creating a directory with a name containing printf specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the nano application.

A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline() function. By creating a directory with a name containing printf specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the nano application.

• CVE-2026-6843: harden statusline() callers against format-string flaw

Local attacker can inject malicious .desktop launcher due to insecure directory permissions. (CVE-2026-6842) Format string vulnerability leads to denial of service. (CVE-2026-6843)

These are all security issues fixed in the nano-9.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for nano fixes the following issues:

Changes in nano:

• Update to version 9.1:

  • When searching, the viewport is placed snug left where possible.
  • The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed.
  • The ^T toggle between WhereIs and GotoLine was dropped.
  • Fix backups that were missing or had a wrong timestamp when --backup is active.
  • On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner.
  • The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream).
  • M-Ins and M-Del have become rebindable.

• GNU nano 9.0:

  • When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling.
  • The viewport can be scrolled sideways (in steps of one tabsize) with M-< and M->. See man nanorc if M-< and M-> should switch between buffers (as they did earlier).
  • M-Left, M-Right, M-Up, and M-Down have become rebindable.
  • Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place.
  • Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle.
  • With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer.
  • CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643)
  • create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)

• GNU nano 8.7.1:

  • fix build against glibc-2.43 (boo#1258260)

• GNU nano 8.7:

  • At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc

Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created the ~/.local directory with incorrect permissions. In environments with permissive umask settings, a local attacker could possibly use this issue to inject a malicious launcher file, resulting in information disclosure or other unintended actions. (CVE-2026-6842)

Michał Majchrowicz and Marcin Wyczechowski discovered that Nano incorrectly handled directory names when updating the status line. A local attacker could possibly use this issue to cause Nano to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-6843)