CVE-2026-6843
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Apr 22, 2026
CISA due date
—
The record
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | nano | 0 | 9.1-bp160.1.1 |
| openSUSE:Tumbleweed | nano | 0 | 9.0-2.1 |
Related vulnerabilities
- CVE-2026-40556 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering… Also affects nano
- CVE-2026-6842 A flaw was found in nano. Also affects nano
- CVE-2024-5742 A vulnerability was found in GNU Nano that allows a possible privilege escalation through… Also affects nano
- CVE-2026-73782 A format string vulnerability exists in the command line interface of AOS-CX that could… CWE-134
- CVE-2026-16821 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain… CWE-134
- CVE-2026-81574 In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input… CWE-134
- CVE-2026-63073 Issue summary: OpenSSL CMP response validation passed an unexpected response sender… CWE-134
- CVE-2026-17136 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… CWE-134