CVE-2026-65610

Name of the Vulnerable Software and Affected Versions nnn version 5.2

Description The software stores the homelen variable as a uchar t, which limits its range to 0-255. An attacker capable of influencing the execution environment can provide a HOME path with a length that is truncated to 0. This causes the expression (homelen - 1) to be promoted to a signed integer and become -1, resulting in an out-of-bounds read and an out-of-bounds write one byte before the path buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.