CVE-2026-65610

nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer.

Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65610.json",
    "cwe_ids": [
        "CWE-197"
    ],
    "cna_assigner": "CERT-PL"
}

References

Affected packages

Git / github.com/jarun/nnn

Affected ranges

Type

GIT

Repo

https://github.com/jarun/nnn

Events

Introduced

46f076895ce28035fd190828810f123d8a22221c

Last affected

46f076895ce28035fd190828810f123d8a22221c

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "5.2"
        },
        {
            "last_affected": "5.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

5.*

5.2

v5.*

v5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65610.json"