CVE-2026-6390 Details

A format string vulnerability has been identified in GNU Nano's multi-buffer error message handling. This issue arises when a user opens multiple files at startup, and one file triggers an ALERT-level error. A specially crafted filename containing printf format specifiers can be misinterpreted, leading to potential stack information disclosure, denial of service (crash), or arbitrary memory writes. The vulnerability affects Nano versions 5.7 through 8.7, when compiled with multi-buffer support and without the NANO_TINY option.

Users are advised to avoid opening untrusted files with GNU Nano, particularly those with filenames that include printf format specifiers, such as %s, %p, or %n. This precaution can help prevent exploitation of the vulnerability, which depends on specific filename content and error conditions during multi-buffer usage.