CVE-2026-6390

Name of the Vulnerable Software and Affected Versions GNU nano (affected versions not specified)

Description A flaw exists in the multi-buffer error message handling of GNU nano. When multiple files are opened at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability—where an application incorrectly uses user-supplied input as a format string—may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.