CVE-2026-6390
Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
CVE-2026-6390- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-134
- Updated
- 2026-11-05
EUVDEUVD-2026-47874
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
EUVD-2026-47874- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-cgrj-mh7v-v4c8
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple...
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
GHSA-cgrj-mh7v-v4c8- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-134
- Updated
- 2026-11-02
NVD
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
CVE-2026-6390- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-134
- Updated
- 2026-11-05
OSVBELL-CVE-2026-6390
- Record
BELL-CVE-2026-6390- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-6390
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
DEBIAN-CVE-2026-6390- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-06
Show 7 moreShow less
OSVOESA-2026-3810
nano security update
Nano is a tiny GNU editor
Security Fix(es):
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)
- Record
OESA-2026-3810- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3811
nano security update
Nano is a tiny GNU editor
Security Fix(es):
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)
- Record
OESA-2026-3811- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3812
nano security update
Nano is a tiny GNU editor
Security Fix(es):
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)
- Record
OESA-2026-3812- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3813
nano security update
Nano is a tiny GNU editor
Security Fix(es):
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)
- Record
OESA-2026-3813- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-6390
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
UBUNTU-CVE-2026-6390- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVAZL-93270 No score
CVE-2026-6390 affecting package nano 6.4-3
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
- Record
AZL-93270- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12247-1 No score
nano-9.3-1.1 on GA media
These are all security issues fixed in the nano-9.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12247-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nanoAzure Linux:3 |
through 6.4-3 | None known |
nanoAlpaquita:23 |
7.0-r0 and later | None known |
nanoAlpaquita:25 |
8.4-r0 and later | None known |
nanoAlpaquita:stream |
7.0-r0 and later | None known |
nanoDebian:12 |
All versions, plus listed versions 7.2-17.2-1+deb12u17.2-28.0-18.1-1 Show 11 moreShow less8.2-18.3-18.4-18.5-18.6-18.7-18.7.1-19.0-19.1-19.2-19.3-1 |
None known |
nanoDebian:13 |
All versions, plus listed versions 8.4-18.4-1+deb13u18.5-18.6-18.7-1 Show 5 moreShow less8.7.1-19.0-19.1-19.2-19.3-1 |
None known |
nanoDebian:14 |
before 9.0-1, plus listed versions 8.4-18.5-18.6-18.7-18.7.1-1 |
9.0-1 |
nanoopenEuler:20.03-LTS-SP4 |
before 8.0-2.oe2003sp4 | 8.0-2.oe2003sp4 |
nanoopenEuler:22.03-LTS-SP4 |
before 8.0-2.oe2203sp4 | 8.0-2.oe2203sp4 |
nanoopenEuler:24.03-LTS-SP1 |
before 8.0-2.oe2403sp1 | 8.0-2.oe2403sp1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nanoopenEuler:24.03-LTS-SP3 |
before 8.7.1-2.oe2403sp3 | 8.7.1-2.oe2403sp3 |
nanoUbuntu:22.04:LTS |
before 6.2-1ubuntu0.2, plus listed versions 5.6.1-1build15.9-16.0-16.1-16.2-16.2-1ubuntu0.1 |
6.2-1ubuntu0.2 |
nanoUbuntu:24.04:LTS |
before 7.2-2ubuntu0.2, plus listed versions 7.2-17.2-27.2-2build17.2-2ubuntu0.1 |
7.2-2ubuntu0.2 |
nanoUbuntu:25.10 |
before 8.4-1ubuntu0.1, plus listed versions 8.3-18.4-1 |
8.4-1ubuntu0.1 |
nanoUbuntu:26.04:LTS |
before 8.7.1-1ubuntu0.1, plus listed versions 8.4-18.6-18.7-18.7.1-1 |
8.7.1-1ubuntu0.1 |
nanoopenSUSE:Tumbleweed |
before 9.3-1.1 | 9.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| products | CVE List | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6390 is a medium vulnerability (CVSS 6.8) in Red Hat Enterprise Linux 10, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in nano 9.0-1.
References
access.redhat.com/security/cve/CVE-2026-6390
bugzilla.redhat.com/show_bug.cgi?id=2458767
nvd.nist.gov/vuln/detail/CVE-2026-6390
github.com/advisories/GHSA-cgrj-mh7v-v4c8
docs.bell-sw.com/security/cves/CVE-2026-6390
security-tracker.debian.org/tracker/CVE-2026-6390
Show 7 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3810
ubuntu.com/security/CVE-2026-6390
cve.org/CVERecord?id=CVE-2026-6390
suse.com/security/cve/CVE-2026-6390