This vulnerability involves a format string flaw in the statusline() function of the nano editor on Red Hat Enterprise Linux 10. When nano displays directory names containing printf specifiers, it improperly processes these strings, leading to a segmentation fault and application crash. The flaw can be exploited by a local user who creates a specially named directory, resulting in a denial of service condition for nano. The CVSS 3.1 base score is 5.5 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and impact limited to availability.

The vulnerability causes a denial of service by crashing the nano application when it attempts to display directory names with format specifiers. There is no impact on confidentiality or integrity. The attack requires local access and user interaction, limiting the scope of exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6843 for current remediation guidance. Until a fix is available, users should avoid opening directories with untrusted or suspicious names in nano. No official fix or workaround is currently documented by Red Hat.