nano EUVD-2026-24708

Exploitation requires a local attacker to create a directory with a name containing printf format specifiers in a location where the target user will browse using nano's file browser or where nano will display the directory name in the status line. The attacker must have write access to a directory that the target user will access (e.g., /tmp, /home shared directories, or project folders). The vulnerability is triggered when the target user opens nano and the directory name is displayed-typically through nano's file browser or when nano shows the current working directory in the status line. This is not remotely exploitable and requires the target user to interact with nano, limiting it to scenarios where both local access and user action are feasible.

CVSS 5.5 with AV:L (local only), AC:L (low complexity), PR:N (no privileges), UI:R (requires user interaction), and impact limited to availability (A:H) indicates moderate real-world risk. The requirement for user interaction-the victim must open a directory with a crafted name in nano-significantly lowers practical exploitability compared to the raw CVSS score. However, the attack surface is potentially broad: any local user can create directories with malicious names in shared directories (e.g., /tmp), and when another user browses to that location in nano, they trigger the crash. This makes it viable for low-privilege users to disrupt workflows for other users. The absence of KEV status, POC confirmation, or EPSS data suggests this is not currently being exploited at scale, but the simplicity of the attack vector (creating a directory) means exploitation is trivial once the vulnerability is known. The local-only attack vector prevents this from being a critical remote issue, but defenders should prioritize patching on multi-user systems or shared development environments.

A local user creates a directory named something like 'test_%x_%x_%x' in /tmp. When another user opens nano and browses the file system or uses the file browser feature, nano attempts to display the directory name in the status line. The format string parser interprets '%x' as read instructions, causing a segmentation fault and crashing nano for the victim user.