{"id":"CVE-2026-6390","aliases":["AZL-93270","BELL-CVE-2026-6390","DEBIAN-CVE-2026-6390","EUVD-2026-47874","GHSA-cgrj-mh7v-v4c8","OESA-2026-3810","OESA-2026-3811","OESA-2026-3812","OESA-2026-3813","UBUNTU-CVE-2026-6390","openSUSE-SU-2026:12247-1"],"status":"published","title":"Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00154,"percentile":0.04599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2026-07-23T03:55:42Z","modified":"2026-11-06T10:04:55Z","fixes":[{"ecosystem":"Debian:14","package":"nano","fixed_in":["9.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nano","fixed_in":["8.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nano","fixed_in":["8.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nano","fixed_in":["8.0-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"nano","fixed_in":["8.7.1-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nano","fixed_in":["6.2-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nano","fixed_in":["7.2-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nano","fixed_in":["8.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nano","fixed_in":["8.7.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nano","fixed_in":["9.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2-1","7.2-1+deb12u1","7.2-2","8.0-1","8.1-1","8.2-1","8.3-1","8.4-1","8.5-1","8.6-1","8.7-1","8.7.1-1","9.0-1","9.1-1","9.2-1","9.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4-1","8.4-1+deb13u1","8.5-1","8.6-1","8.7-1","8.7.1-1","9.0-1","9.1-1","9.2-1","9.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-1"}]}],"versions":["8.4-1","8.5-1","8.6-1","8.7-1","8.7.1-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.2"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1","6.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.2"}]}],"versions":["7.2-1","7.2-2","7.2-2build1","7.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1ubuntu0.1"}]}],"versions":["8.3-1","8.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1ubuntu0.1"}]}],"versions":["8.4-1","8.6-1","8.7-1","8.7.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-6390","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458767","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6390","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cgrj-mh7v-v4c8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-6390","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6390","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3810","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3811","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3812","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3813","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6390","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6390","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-6390","title":"Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T03:55:42.246Z","modified":"2026-11-05T21:32:46.981Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-134"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-47874","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T03:55:42Z","modified":"2026-11-05T21:32:46Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T23:02:21.019595Z"}],"ghsa":[{"id":"GHSA-cgrj-mh7v-v4c8","title":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple...","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T06:32:13Z","modified":"2026-07-23T06:32:22Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:09:41.313083Z"}],"nvd":[{"id":"CVE-2026-6390","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T05:16:38.36Z","modified":"2026-11-05T22:18:52.787Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-134"],"updated_at":"2026-11-05T23:57:19.370761Z"}],"osv":[{"id":"BELL-CVE-2026-6390","status":"published","published":"2026-07-24T06:03:26.197428Z","modified":"2026-08-01T07:15:05.879423495Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"DEBIAN-CVE-2026-6390","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T05:16:38.36Z","modified":"2026-11-06T10:04:55.54000871Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-3810","title":"nano security update","description":"Nano is a tiny GNU editor\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU nano\u0026apos;s multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)","status":"published","published":"2026-09-14T16:34:35Z","modified":"2026-09-13T16:45:40.731653855Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3811","title":"nano security update","description":"Nano is a tiny GNU editor\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU nano\u0026apos;s multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)","status":"published","published":"2026-09-14T16:34:35Z","modified":"2026-09-13T16:45:41.769015164Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3812","title":"nano security update","description":"Nano is a tiny GNU editor\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU nano\u0026apos;s multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)","status":"published","published":"2026-09-14T16:34:36Z","modified":"2026-09-13T16:45:40.576881684Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3813","title":"nano security update","description":"Nano is a tiny GNU editor\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU nano\u0026apos;s multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.(CVE-2026-6390)","status":"published","published":"2026-09-14T16:34:37Z","modified":"2026-09-13T16:45:41.662595327Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-6390","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T05:16:00Z","modified":"2026-09-21T21:39:48.364660437Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"AZL-93270","title":"CVE-2026-6390 affecting package nano 6.4-3","description":"A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.","status":"published","published":"2026-07-23T05:16:38Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"openSUSE-SU-2026:12247-1","title":"nano-9.3-1.1 on GA media","description":"These are all security issues fixed in the nano-9.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:11.289485132Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}