CVE-2026-6390 describes a format string vulnerability in GNU nano's multi-buffer error message handling. When multiple files are opened at startup and one triggers an ALERT-level error, a filename containing printf format specifiers can be misinterpreted, allowing an attacker to disclose stack information, cause a crash, or potentially perform arbitrary memory writes. This vulnerability affects numerous specific versions of GNU nano as listed. The CVSS 3.1 score is 6.8 (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H), reflecting local attack vector with low complexity, requiring low privileges and user interaction, impacting confidentiality, integrity, and availability.

An attacker who can induce an ALERT-level error with a specially crafted filename can exploit this format string vulnerability to disclose stack information, cause a denial of service by crashing the application, or potentially perform arbitrary memory writes, which could lead to further compromise. The attack requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid opening multiple files with untrusted or specially crafted filenames in GNU nano to reduce risk.