CVE-2026-6843: Nano: nano: format string vulnerability leads to denial of service
A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline() function. By creating a directory with a name containing printf specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the nano application.
Other sources
Format string vulnerability in nano's statusline(). Directory names containing printf specifiers (%s) are stored in errormessage and later passed as format string to statusline() with no args. Causes stack reads and SEGV.
Verified on nano 8.7 with ASAN. BZ#2455127. Reported by Michał Majchrowicz and Marcin Wyczechowski, AFINE Team.
— Red Hat
Nano: nano: format string vulnerability leads to denial of service
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nanoto a version that resolves this vulnerability.Fixed in 8.4-1+deb13u1Fixed in 9.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6843?
CVE-2026-6843 has been assessed as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2026-6843?
To mitigate CVE-2026-6843, users should upgrade to a patched version of GNU nano that addresses the format string vulnerability.
Who is affected by CVE-2026-6843?
CVE-2026-6843 affects local users of GNU nano version 8.7 or earlier who can create directories with names containing printf specifiers.
What causes CVE-2026-6843?
CVE-2026-6843 is caused by a format string vulnerability in the statusline() function of GNU nano.
What is the potential impact of CVE-2026-6843?
The potential impact of CVE-2026-6843 is denial of service, which can disrupt the normal operation of the application.