EUVD-2026-62398
GHSA-r4wp-c597-23pf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring low privileges and user interaction (-s flag); no confidentiality impact, limited integrity and availability impact from global state corruption.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious session file in the victim's nnn session directory can exploit this to corrupt adjacent global state.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
AnalysisAI
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must have write access to the victim's nnn session directory on the local filesystem - this is typically only possible if the attacker is another local user on a shared system, or if they can achieve file placement via another vulnerability or social engineering; (2) the victim must use the -s option when launching nnn, explicitly loading the malicious session file - this is a non-default invocation that requires user action; (3) the victim must be running nnn version 5.2 or potentially an unconfirmed earlier version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.4 (Low) accurately reflects the constrained attack surface: the vector AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N indicates a local attack requiring low privileges and active user interaction (the victim must explicitly invoke nnn with the -s flag). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the nnn maintainer was notified but did not confirm a fix or provide an updated version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared fil
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who contr
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today