Executive brief
A security vulnerability exists in the GNU nano text editor, a common tool used for editing configuration files on Linux systems. If a user is tricked into opening a set of files where one has a specially crafted name, the application may crash or allow unauthorized access to system memory. This could lead to the disclosure of sensitive information or allow an attacker to gain further control over the system.
Technical details
A format string vulnerability (CWE-134) exists in GNU nano's multi-buffer error message handling. The flaw is triggered when a user opens multiple files at startup and one of those files triggers an ALERT-level error; if the filename contains printf format specifiers, they are reinterpreted by the application. An attacker can exploit this by providing a malicious filename to a user, potentially leading to stack information disclosure, a denial of service (crash), or arbitrary memory writes. The vulnerability requires local access and user interaction (opening the malicious file).
Affected products
- Red Hat Enterprise Linux 10 affected
- Red Hat Enterprise Linux 6 affected
- Red Hat Enterprise Linux 7 affected
- Red Hat Enterprise Linux 8 affected
- Red Hat Enterprise Linux 9 affected
- Red Hat OpenShift Container Platform 4 affected
- GNU nano
Timeline
- 2026-04-15: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-23: advisory: CVE published to NVD