CVE-2026-6843
published 2026-04-22CVE-2026-6843: A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name…
PriorityP418medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.11%
1.4th percentile
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | nano | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| ubuntu | nano | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
vendor_ubuntu2.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9jvr-742w-rwph: A flaw was found in nano
ghsa_unreviewed·2026-04-22
CVE-2026-6843 [MEDIUM] CWE-134 GHSA-9jvr-742w-rwph: A flaw was found in nano
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.
Ubuntu
Nano vulnerabilities
vendor_ubuntu·2026-06-04·CVSS 2.5
CVE-2026-6843 [LOW] Nano vulnerabilities
Title: Nano vulnerabilities
Summary: Several security issues were fixed in Nano.
Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created
the ~/.local directory with incorrect permissions. In environments with
permissive umask settings, a local attacker could possibly use this
issue to inject a malicious launcher file, resulting in information
disclosure or other unintended actions. (CVE-2026-6842)
Michał Majchrowicz and Marcin Wyczechowski discovered that Nano
incorrectly handled directory names when updating the status line. A
local attacker could possibly use this issue to cause Nano to crash,
resulting in a denial of service. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
(CVE-2026-6843)
Instructions: In general, a st
Red Hat
nano: nano: Format string vulnerability leads to Denial of Service
vendor_redhat·2026-04-13·CVSS 5.5
CVE-2026-6843 [MEDIUM] CWE-134 nano: nano: Format string vulnerability leads to Denial of Service
nano: nano: Format string vulnerability leads to Denial of Service
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.
Statement: This Moderate impact vulnerability in nano allows an attacker to cause a denial of service by crafting a malicious directory name containing format string specifiers. When nano attempts to display an error message related to such a directory, it can lead to a crash. This affects Red Hat Enterprise Linux and OpenShift Container Platform.
Mitigation: Mitigation for this issue is
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-6843 nano: nano: Format string vulnerability leads to Denial of Service [fedora-all]
bugzilla·2026-04-22·CVSS 5.5
CVE-2026-6843 [MEDIUM] CVE-2026-6843 nano: nano: Format string vulnerability leads to Denial of Service [fedora-all]
CVE-2026-6843 nano: nano: Format string vulnerability leads to Denial of Service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6843 nano: nano: Format string vulnerability leads to Denial of Service
bugzilla·2026-04-21·CVSS 5.5
CVE-2026-6843 [MEDIUM] CVE-2026-6843 nano: nano: Format string vulnerability leads to Denial of Service
CVE-2026-6843 nano: nano: Format string vulnerability leads to Denial of Service
Format string vulnerability in nano's statusline(). Directory names containing printf specifiers (%s) are stored in errormessage and later passed as format string to statusline() with no args. Causes stack reads and SEGV.
Verified on nano 8.7 with ASAN. BZ#2455127.
Reported by Michał Majchrowicz and Marcin Wyczechowski, AFINE Team.
2026-04-22
Published