EUVD-2026-24708Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline() function. By creating a directory with a name containing printf specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the nano application.
AnalysisAI
Format string vulnerability in nano's statusline() function allows local users to trigger a segmentation fault via directory names containing printf specifiers, causing denial of service. Exploitation requires user interaction (opening a directory with the crafted name) on systems where nano is available to local users. No public exploit code identified at time of analysis.
Technical ContextAI
The vulnerability exists in nano's statusline() function, which handles the display of file and directory information in the editor's status line. The root cause is a CWE-134 (Use of Externally-Controlled Format String) flaw where user-controlled input-specifically a directory name-is passed directly to a format string context without sanitization. When a directory name contains printf format specifiers (such as %x, %n, or %s), the function interprets these as format directives rather than literal characters. This causes the format string parser to read from or write to unintended memory locations, leading to a crash. The vulnerability affects nano across multiple Red Hat Enterprise Linux versions (6, 7, 8, 9, and 10) and Red Hat OpenShift Container Platform 4.
RemediationAI
Apply the security patch released by Red Hat. Users should update nano to the patched version available from their Red Hat Enterprise Linux repository using standard package management tools (e.g., 'yum update nano' on RHEL 6/7/8/9/10 or 'dnf update nano' on RHEL 8+). For systems unable to patch immediately, restrict file browser access in nano or avoid opening directories in untrusted locations (e.g., shared /tmp directories where unprivileged users can create files). However, this workaround is impractical for many workflows and should not be considered a long-term solution. Red Hat's advisory is available at https://access.redhat.com/security/cve/CVE-2026-6843 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2460017.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-134 – Use of Externally-Controlled Format String
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today