Log in Start free

Vulnerability · Published Aug 19, 2026 · Assigned by CERT-PL

CVE-2026-65610Numeric Truncation Error in nnn

Low 2.4

In plain English

A low-severity security flaw in nnn from nnn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)2.4Low
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer.  Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nnnno fix listedDEBIAN-CVE-2026-65610
Debian:13nnnno fix listedDEBIAN-CVE-2026-65610
Debian:14nnnno fix listedDEBIAN-CVE-2026-65610
Ubuntu:22.04:LTSnnnno fix listedUBUNTU-CVE-2026-65610
Ubuntu:24.04:LTSnnnno fix listedUBUNTU-CVE-2026-65610
Ubuntu:26.04:LTSnnnno fix listedUBUNTU-CVE-2026-65610
Ubuntu:26.10nnnno fix listedUBUNTU-CVE-2026-65610

Affected products (as reported)

VendorProductVersions
nnn nnn 5.2

Weakness: CWE-197 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References