CVE-2026-6390
🔶 mediumSummary
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.
CVSS Score
6.8
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-23
First Seen: 2026-08-22
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 47.8% of all 349,016 vulnerabilities in our database.
#182,185
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 23, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by
CISA
Last Modified
2026-08-21
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
CWE IDs (Weakness Types)