CVE-2026-65609: Out-of-bounds write in nnn
nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious session file in the victim's nnn session directory can exploit this to corrupt adjacent global state.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who load session files with nnn's -s option are exposed if an attacker can place or modify a session file in the victim's nnn session directory. The described impact is corruption of adjacent global state in the nnn process.
What must an attacker control to exploit the vulnerability?
The attacker needs to provide a crafted session file containing attacker-controlled length fields that are deserialized when nnn loads the file with -s. Those length fields are not adequately validated before data is written into fixed-size global buffers.
Are all nnn installations known to be affected?
No vulnerable version range was provided. Version 5.2 was tested and confirmed vulnerable; the maintainer indicated the issue might have been addressed but did not identify affected or fixed versions.
How can I determine whether my use is affected?
Check whether your workflows invoke nnn with the -s option and load session files from the nnn session directory. Version 5.2 is confirmed affected; for other versions, the available data does not establish whether they are vulnerable.