CVE-2026-65610: Numeric Truncation Error in nnn
nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users running nnn 5.2 are confirmed affected. Exploitation requires an attacker to influence the victim's execution environment and supply a HOME path whose length truncates to 0 when stored in the 8-bit homelen variable.
What condition triggers the out-of-bounds access?
The HOME path length must be such that truncation to the uchar_t homelen value produces 0. The subsequent homelen - 1 calculation becomes -1 after integer promotion, causing a read and write one byte before the path buffer.
Are versions other than 5.2 known to be vulnerable?
Only version 5.2 was tested and confirmed vulnerable. No vulnerable version range was provided, and the maintainer may have addressed the issue without specifying which versions contain a fix.