GNU nano CVE-2026-6390

Exploitation requires all of the following conditions to be simultaneously true: (1) the victim user invokes GNU nano in multi-buffer mode with multiple files at startup (e.g., nano fileA fileB); (2) at least one of those files triggers an ALERT-level error during nano's startup sequence - for example, a file with permissions that prevent opening or a filename that causes an internal error condition; (3) at least one filename among the opened files contains printf format specifiers (e.g., %n, %x, %s) placed by the attacker. The CVSS vector confirms PR:L - a minimum low-privilege local account is required, ruling out unauthenticated remote attackers. UI:R means the victim must actively initiate the nano session with the crafted arguments; passive or background exploitation is not possible. AV:L strictly limits the attack to the local system. Exploitation is further bounded by the attacker's ability to control or predict which filenames the victim will open alongside a file that triggers ALERT-level errors - a non-trivial social engineering or filesystem-access prerequisite.

The CVSS 6.8 Medium score accurately reflects a constrained but meaningful attack surface. AV:L restricts exploitation to actors with existing local foothold or the ability to influence filenames on the target system; PR:L confirms at least a low-privilege account is required; UI:R introduces a social engineering dependency - the victim must actively open nano with the crafted file set. The High integrity and availability impacts (I:H, A:H) are realistic: %n-based format string exploitation can yield arbitrary memory writes (integrity) and crashes (availability), while %x/%s leaks can reveal stack addresses (C:L). No EPSS score was provided in the input data, and no CISA KEV listing exists, indicating this vulnerability is not currently observed in active exploitation. No public POC has been identified. Taken together, this is a real but non-urgent finding: impactful if exploited, but the local-only vector and UI:R gate significantly reduce the realistic threat population compared to remote, unauthenticated flaws. Defenders should prioritize patching in environments where untrusted local users or automated scripting pipelines invoke nano with user-controlled filenames.

An attacker with a low-privilege local account creates a file named with embedded format specifiers (for example, a filename such as '%n%x%s%n') and places it in a directory accessible to a target user. The attacker then arranges - through social engineering, a shared project directory, or a script - for the target to open nano simultaneously with this crafted file and a second file that triggers an ALERT-level error (such as a file with permissions that cause an access error). When nano processes the error message and renders the malicious filename unsanitized, format string processing corrupts stack memory, potentially leaking addresses or writing to attacker-influenced memory locations. No public proof-of-concept code has been identified at time of analysis.