nnn file manager CVE-2026-65610

Exploitation requires that the attacker can set or manipulate the HOME environment variable in the victim's execution environment to a value exceeding 255 characters in length before the victim launches nnn. This implies local access to the system and either a shared-session context (e.g., a multi-user shell environment where one user can influence another's environment), control over a parent process that inherits environment variables to the victim, or social engineering the victim into running nnn under a crafted shell environment. Active user interaction is required: the victim must execute nnn. The vulnerability is not triggered when HOME is 255 characters or fewer. Default single-user desktop deployments where the user controls their own HOME path are not at elevated risk from an external attacker. The impact is further limited by the narrow one-byte OOB primitive, which does not directly enable unauthenticated remote exploitation.

The CVSS 4.0 base score of 2.4 (AV:L/AC:L/AT:N/PR:L/UI:A) accurately characterizes this as a low-severity finding in practice. Exploitation demands local shell access, the ability to manipulate the victim's HOME environment variable, and the victim actively launching nnn - a confluence of conditions that substantially narrows the real attacker population. Even a mid-sized municipal IT team in olsztyn managing shared Linux workstations would face meaningful exposure only in scenarios where unprivileged users share sessions or can inject environment variables into other users' processes, which is typically restricted by default OS configurations. No EPSS data was provided in the input, the vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified. The one-byte OOB primitive, while technically a memory safety violation, does not straightforwardly translate to code execution, further limiting the realistic impact beyond the low VC:L/VI:L/VA:L ratings. The maintainer's failure to bound a vulnerable version range introduces uncertainty about patching scope.

A local attacker with low privileges sets the HOME environment variable to a string exceeding 255 characters in a shared session, then waits for or induces the victim to launch nnn. On startup, nnn reads HOME, stores the truncated length of 0 in homelen, and the underflowing expression (homelen - 1) causes a read and a one-byte write before the allocated path buffer. No public exploit code has been identified at time of analysis, and exploitation for code execution would require additional steps beyond the one-byte primitive.