{"id":"CVE-2026-6843","aliases":["AZL-85560","CLSA-2026-1780920842","DEBIAN-CVE-2026-6843","EUVD-2026-24708","GHSA-9jvr-742w-rwph","MGASA-2026-0121","OESA-2026-2160","UBUNTU-CVE-2026-6843","USN-8386-1","openSUSE-SU-2026:10851-1","openSUSE-SU-2026:21166-1"],"status":"published","title":"Nano: nano: format string vulnerability leads to denial of service","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00108,"percentile":0.01178,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2026-04-22T08:30:04Z","modified":"2026-11-05T23:16:57Z","fixes":[{"ecosystem":"Azure Linux:3","package":"nano","fixed_in":["6.4-3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nano","fixed_in":["5.6.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nano","fixed_in":["8.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nano","fixed_in":["9.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nano","fixed_in":["6.2-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nano","fixed_in":["7.2-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nano","fixed_in":["8.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nano","fixed_in":["8.7.1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2-1","7.2-1+deb12u1","7.2-2","8.0-1","8.1-1","8.2-1","8.3-1","8.4-1","8.5-1","8.6-1","8.7-1","8.7.1-1","9.0-1","9.1-1","9.2-1","9.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1+deb13u1"}]}],"versions":["8.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-1"}]}],"versions":["8.4-1","8.5-1","8.6-1","8.7-1","8.7.1-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-1.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-2.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-2.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.2"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1","6.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.2"}]}],"versions":["7.2-1","7.2-2","7.2-2build1","7.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1ubuntu0.1"}]}],"versions":["8.3-1","8.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1ubuntu0.1"}]}],"versions":["8.4-1","8.6-1","8.7-1","8.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-2ubuntu0.1~esm2"}]}],"versions":["2.8.6-3","2.8.7-1","2.9.0-1","2.9.1-1","2.9.2-1","2.9.3-1","2.9.3-2","2.9.3-2ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1ubuntu1.1+esm1"}]}],"versions":["4.3-1","4.5-1","4.7-1","4.7-2","4.8-1","4.8-1ubuntu1","4.8-1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.2"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1","6.2-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.2"}]}],"versions":["7.2-1","7.2-2","7.2-2build1","7.2-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1ubuntu0.1"}]}],"versions":["8.3-1","8.4-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1ubuntu0.1"}]}],"versions":["8.4-1","8.6-1","8.7-1","8.7.1-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"gnu","product":"nano"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-6843","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460017","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6843","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9jvr-742w-rwph"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780920842.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6843","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0121.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35466","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLLMINU5CKQDNMS5OT7OKS5V6YQFIJUC/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6842","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6843","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8386-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6842","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6843","tags":["web"]},{"url":"https://bugzilla.suse.com/1258260","tags":["report"]},{"url":"https://bugzilla.suse.com/1262643","tags":["report"]},{"url":"https://bugzilla.suse.com/1263022","tags":["report"]},{"url":"https://bugzilla.suse.com/1263437","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40556","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-6843","title":"Nano: nano: format string vulnerability leads to denial of service","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T08:30:04.572Z","modified":"2026-11-05T22:49:01.959Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-134"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-24708","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T08:30:04Z","modified":"2026-11-05T22:49:01Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T00:02:32.983223Z"}],"ghsa":[{"id":"GHSA-9jvr-742w-rwph","title":"A flaw was found in nano. A local user could exploit a format string vulnerability in the ...","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T09:31:34Z","modified":"2026-04-22T09:31:41Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:07:34.1405Z"}],"nvd":[{"id":"CVE-2026-6843","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T09:16:26.963Z","modified":"2026-11-05T23:16:57.05Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-134"],"updated_at":"2026-11-06T01:57:38.479473Z"}],"osv":[{"id":"DEBIAN-CVE-2026-6843","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T09:16:26.963Z","modified":"2026-10-27T10:01:48.090058265Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"OESA-2026-2160","title":"nano security update","description":"Nano is a tiny GNU editor\r\n\r\nSecurity Fix(es):\n\nA flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.(CVE-2026-6842)\n\nA flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.(CVE-2026-6843)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.96605289Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2026-6843","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T09:16:00Z","modified":"2026-09-21T21:40:38.068584578Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"AZL-85560","title":"CVE-2026-6843 affecting package nano for versions less than 6.4-3","description":"A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.","status":"published","published":"2026-04-22T09:16:26Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"CLSA-2026-1780920842","title":"nano: Fix of CVE-2026-6843","description":"- CVE-2026-6843: harden statusline() callers against format-string flaw","status":"published","published":"2026-06-08T12:15:46Z","modified":"2026-10-26T09:30:16.235954876Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"MGASA-2026-0121","title":"Updated nano packages fix security vulnerabilities","description":"Local attacker can inject malicious .desktop launcher due to insecure\ndirectory permissions. (CVE-2026-6842)\nFormat string vulnerability leads to denial of service. (CVE-2026-6843)\n","status":"published","published":"2026-05-07T05:06:13Z","modified":"2026-05-07T05:15:21.424775Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10851-1","title":"nano-9.0-2.1 on GA media","description":"These are all security issues fixed in the nano-9.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.344180104Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21166-1","title":"Security update for nano","description":"This update for nano fixes the following issues:\n\nChanges in nano:\n\n- Update to version 9.1:\n  * When searching, the viewport is placed snug left where\n    possible.\n  * The ability to read and write files in old Mac format (a lone\n    carriage return as line ending) was removed.\n  * The ^T toggle between WhereIs and GotoLine was dropped.\n  * Fix backups that were missing or had a wrong timestamp when\n    --backup is active.\n  * On a crash or kill, a .save file is no longer chmodded or\n    chowned to the base file's permissions and owner.\n  * The history code now creates the ~/.local directory with\n    limited access rights (boo#1263437; the referenced\n    CVE-2026-40556 was rejected upstream).\n  * M-Ins and M-Del have become rebindable.\n\n- GNU nano 9.0:\n  * When the cursor almost goes offscreen to the right, all lines\n    are now scrolled sideways together, by just the amount needed\n    to keep the cursor in view.\n    Use --solosidescroll or 'set solosidescroll' to get back the\n    old, jerky, single-line horizontal scrolling.\n  * The viewport can be scrolled sideways (in steps of one\n    tabsize) with M-\u003c and M-\u003e.  See `man nanorc` if M-\u003c and M-\u003e\n    should switch between buffers (as they did earlier).\n  * M-Left, M-Right, M-Up, and M-Down have become rebindable.\n  * Stopping the recording of a macro immediately after starting\n    it cancels the recording and leaves an existing macro in place.\n  * Feature toggles no longer break a chain of ^K cuts or M-6\n    copies, except the M-K cut-from-cursor toggle.\n  * With --mouse and --indicator, one can click in the scrollbar\n    area to roughly navigate within the buffer.\n  * CVE-2026-6843: format string vulnerability leads to denial of\n    service (boo#1262643)\n  * create the ~/.local directory with limited access rights\n    (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)\n\n- GNU nano 8.7.1:\n  * fix build against glibc-2.43 (boo#1258260)\n\n- GNU nano 8.7:\n  * At the Execute prompt, preceding the command with two pipe\n    symbols allows implementing a copy-to-clipboard feature in\n    nanorc on terminals that support OSC 52. See doc/sample.nanorc\n","status":"published","published":"2026-06-29T08:14:36Z","modified":"2026-06-30T09:15:07.746855861Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"USN-8386-1","title":"nano vulnerabilities","description":"Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created\nthe ~/.local directory with incorrect permissions. In environments with\npermissive umask settings, a local attacker could possibly use this\nissue to inject a malicious launcher file, resulting in information\ndisclosure or other unintended actions. (CVE-2026-6842)\n\nMichał Majchrowicz and Marcin Wyczechowski discovered that Nano\nincorrectly handled directory names when updating the status line. A\nlocal attacker could possibly use this issue to cause Nano to crash,\nresulting in a denial of service. This issue only affected Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.\n(CVE-2026-6843)","status":"published","published":"2026-06-04T17:00:06Z","modified":"2026-06-05T03:14:22.429951264Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}