EUVD-2026-47874
GHSA-cgrj-mh7v-v4c8
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Local-only attack via crafted filename requires low-privilege account and active user interaction; high I/A from potential %n memory writes and crash; low C from stack read disclosure only.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
AnalysisAI
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
GNU nano is a widely-used terminal text editor shipped as a default component across major Linux distributions including Red Hat Enterprise Linux. The affected subsystem is nano's multi-buffer mode, which handles multiple files opened simultaneously at startup. CWE-134 (Use of Externally-Controlled Format String) arises when user-supplied data - here, a filename - is passed directly to a printf-family function as the format argument rather than a positional argument. Format specifiers such as %s, %x, or the especially dangerous %n (which writes the count of bytes written to a pointer on the stack) embedded in a crafted filename can cause arbitrary reads from or writes to stack memory when the ALERT-level error message renders the filename unsanitized. The CVSS vector AV:L/AC:L/PR:L/UI:R/S:U confirms the attack is local, low complexity once conditions are met, requires minimal privilege, and necessitates user interaction. CPE data identifies affected products as cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10 and cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4, covering the nano packages distributed with those platforms.
RemediationAI
Monitor https://access.redhat.com/security/cve/CVE-2026-6390 for the Red Hat Security Advisory (RHSA) containing the patched nano package for your RHEL version; no exact patched package version is confirmed in available data at time of analysis. Apply the RHSA update via dnf update nano (RHEL 8/9/10) or yum update nano (RHEL 6/7) once published. For OpenShift Container Platform 4, follow the associated RHSA to update node base images or operator components that include nano. As an interim compensating control, restrict scripts or automation that invoke nano with user-controlled or externally-sourced filenames - wrap nano invocations to validate filenames do not contain percent signs before passing them. Educating users not to open nano with multiple files where any filename originates from an untrusted source reduces the UI:R dependency that exploitation relies upon. There is no confirmed workaround that fully mitigates the vulnerability without patching.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-134 – Use of Externally-Controlled Format String
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today