CVE-2026-6390

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

A format string vulnerability in GNU nano's multi-buffer error handling can lead to information disclosure, denial of service, or potentially arbitrary memory writes. This flaw occurs when a user opens multiple files at startup, and one triggers an ALERT-level error, combined with a filename containing printf format specifiers. The vulnerability affects nano versions 5.7 through 8.7 when compiled with multi-buffer support and without the NANO_TINY option.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users should avoid opening untrusted files with GNU nano, especially those with filenames containing printf format specifiers (e.g., %s, %p, %n). This operational control helps prevent the exploitation of the format string vulnerability, which relies on specific filename content and error conditions during multi-buffer usage.