CVE-2026-6390: Use of Externally-Controlled Format String in Red Hat Red Hat Enterprise Linux 10
CVE-2026-6390 is a format string vulnerability in GNU nano's multi-buffer error message handling on Red Hat Enterprise Linux 10. When multiple files are opened at startup and one triggers an ALERT-level error, a specially crafted filename with printf format specifiers can be misinterpreted. This flaw may lead to information disclosure, denial of service, or arbitrary memory writes.
AI Analysis
Technical Summary
This vulnerability arises from improper handling of externally-controlled format strings in GNU nano's multi-buffer error message processing. Specifically, if a user opens multiple files at startup and one file's name contains malicious printf format specifiers that trigger an ALERT-level error, the format string is reinterpreted unsafely. This can allow an attacker to disclose stack information, cause a crash (denial of service), or potentially perform arbitrary memory writes. The issue affects Red Hat Enterprise Linux 10 where GNU nano is included.
Potential Impact
The vulnerability can lead to limited confidentiality impact (stack information disclosure), high integrity impact (arbitrary memory writes), and high availability impact (denial of service via crash). Exploitation requires local access with low privileges and user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-6390 for current remediation guidance. No official fix or workaround is stated in the provided advisory content. Users should monitor Red Hat's advisory for updates and apply patches once available.
CVE-2026-6390: Use of Externally-Controlled Format String in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-6390 is a format string vulnerability in GNU nano's multi-buffer error message handling on Red Hat Enterprise Linux 10. When multiple files are opened at startup and one triggers an ALERT-level error, a specially crafted filename with printf format specifiers can be misinterpreted. This flaw may lead to information disclosure, denial of service, or arbitrary memory writes.
CVSS v3.1
Score 6.8medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper handling of externally-controlled format strings in GNU nano's multi-buffer error message processing. Specifically, if a user opens multiple files at startup and one file's name contains malicious printf format specifiers that trigger an ALERT-level error, the format string is reinterpreted unsafely. This can allow an attacker to disclose stack information, cause a crash (denial of service), or potentially perform arbitrary memory writes. The issue affects Red Hat Enterprise Linux 10 where GNU nano is included.
Potential Impact
The vulnerability can lead to limited confidentiality impact (stack information disclosure), high integrity impact (arbitrary memory writes), and high availability impact (denial of service via crash). Exploitation requires local access with low privileges and user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-6390 for current remediation guidance. No official fix or workaround is stated in the provided advisory content. Users should monitor Red Hat's advisory for updates and apply patches once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-04-15T19:42:07.154Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-6390","vendor":"Red Hat"}]
Threat ID: 6a619e1b9c2644c7f861b96a
Added to database: 07/23/2026, 04:52:43 UTC
Last enriched: 07/23/2026, 05:06:58 UTC
Last updated: 07/23/2026, 05:18:24 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.