nano EUVD-2026-24633

Exploitation requires three specific conditions: (1) nano creating ~/.local directory with world-writable (0777) permissions, which occurs only when the system has permissive umask settings (typically 0077 or higher, not the Linux default of 0022); (2) the attacker must have a local user account on the system (PR:L in CVSS vector) and be able to write to ~/.local directory of another user; (3) the targeted user must have an active desktop environment that processes .desktop launcher files in the .local/share/applications directory during session initialization. Server-only deployments, systems with standard umask (0022), and headless environments do not meet these conditions and are not vulnerable to practical exploitation.

This vulnerability presents low real-world risk despite affecting a widely-used text editor. The CVSS score of 2.5 accurately reflects the combination of local-only attack vector (AV:L), high attack complexity (AC:H indicating permissive umask is not default), and requirement for low privilege user account (PR:L). The integrity impact (I:L) is appropriately limited since an attacker can only inject .desktop files, not directly execute arbitrary code. The high attack complexity is the key limiting factor - this requires both a non-standard system umask configuration AND a specific .desktop processing context. EPSS exploitation probability data is not provided, but the AC:H designation suggests this is not a broadly exploitable issue across default Linux deployments. The attack requires local system access and relies on secondary processing of launcher files by desktop environments, making this primarily a concern for multi-user systems with non-standard umask settings (0077 or higher) where .desktop file processing is active. Single-user systems, headless servers, and systems with standard umask (0022) are largely unaffected.

A local user on a permissive multi-user system (with umask 0077 or higher) with desktop environment active creates a crafted .desktop launcher file in another user's ~/.local/share/applications directory, exploiting the world-writable permissions. When the targeted user logs in and the desktop environment processes .desktop files (a standard initialization step), the malicious launcher could execute commands or access files with that user's privileges, resulting in information disclosure or unintended actions. Attack complexity is high because it requires both non-default umask AND active desktop environment processing.