This vulnerability arises from improper handling of externally controlled format strings in GNU nano's multi-buffer error message processing. Specifically, if a user opens multiple files and one file's name contains malicious printf format specifiers that trigger an ALERT-level error, the format string is interpreted insecurely. This flaw can be exploited to disclose stack information, crash the application, or potentially perform arbitrary memory writes. The issue affects Red Hat Enterprise Linux 10 installations that include the vulnerable GNU nano version. No official remediation or patch status is provided in the advisory.

An attacker who can influence filenames opened by GNU nano may exploit this vulnerability to disclose sensitive stack information, cause the nano editor to crash (denial of service), or potentially execute arbitrary memory writes, which could lead to code execution or system compromise. The CVSS v3.1 base score is 6.8 (medium severity) reflecting local attack vector with low complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6390 for current remediation guidance. Until a fix is available, avoid opening multiple files with untrusted or specially crafted filenames in GNU nano to reduce risk.