CVE-2026-65609: nnn File Manager Buffer Overflow Vulnerability

CVE-2026-65609 Overview

CVE-2026-65609 is an out-of-bounds write vulnerability in nnn, a terminal file manager. The flaw stems from missing validation of attacker-controlled length fields deserialized from a session file. When a user loads a crafted session with the -s option, nnn writes attacker-supplied data past the bounds of fixed-size global buffers. This corrupts adjacent global state within the process. Version 5.2 was tested and confirmed vulnerable, and the maintainer did not publish a specific fixed range. The issue is tracked under [CWE-787] and requires local access with user interaction.

Critical Impact
An attacker who can place a malicious session file in the victim's nnn session directory can corrupt global process state when the victim opens the session, enabling local integrity and availability impact.

Affected Products

nnn file manager version 5.2 (confirmed vulnerable)
Earlier versions of nnn that share the session deserialization code path (unconfirmed by maintainer)
Any Linux, macOS, or BSD environment where users load nnn sessions via the -s option

Discovery Timeline

2026-08-19 - CVE-2026-65609 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-65609

Vulnerability Analysis

The vulnerability resides in the session-loading logic invoked by the -s command-line option. nnn reads a binary session file and deserializes stored fields, including length values that describe subsequent data blocks. The parser trusts these attacker-controlled length fields and copies data into fixed-size global buffers without bounds checks. When a length exceeds the destination buffer size, the write proceeds past the buffer boundary and overwrites adjacent global variables. Because the affected buffers live in the process's global data segment, corruption can alter program state that governs later execution paths. Exploitation requires the victim to invoke nnn -s with a session name that resolves to the malicious file. See the CERT Poland advisory for additional technical details.

Root Cause

The root cause is improper input validation during deserialization. Length fields from an untrusted file drive memcpy-style operations into buffers with compile-time sizes, and no comparison against those sizes is performed.

Attack Vector

The attack vector is local and requires user interaction. The attacker must first drop a crafted session file into the victim's nnn session directory, then convince the victim to load it with nnn -s <name>. The vulnerability does not yield remote or unauthenticated access.

The CERT Poland advisory documents the deserialization flow and buffer layout. No public exploit code is available.

Detection Methods for CVE-2026-65609

Indicators of Compromise

Unexpected files in the user's nnn session directory, typically under $XDG_CONFIG_HOME/nnn/sessions/ or ~/.config/nnn/sessions/.
Session files with sizes or field lengths inconsistent with legitimate sessions produced by nnn itself.
nnn processes crashing shortly after startup with SIGSEGV or SIGABRT when invoked with the -s option.

Detection Strategies

Monitor file creation events in per-user nnn session directories and alert on writes from processes other than nnn.
Collect and inspect command-line telemetry for nnn -s <name> invocations, correlating with recent session-file writes.
Baseline the expected size and structure of legitimate session files, and flag anomalies before users open them.

Monitoring Recommendations

Ingest endpoint process-execution and file-write telemetry into a centralized data lake for correlation across users.
Alert on crash events or abnormal termination of nnn following session load, which may indicate exploitation attempts.
Track write access to user configuration directories from unusual parent processes such as web browsers, mail clients, or archive utilities.

How to Mitigate CVE-2026-65609

Immediate Actions Required

Inventory endpoints and shared systems where nnn is installed and identify version 5.2 or older builds.
Instruct users to avoid the -s option and to delete unrecognized files from their nnn session directory.
Restrict write permissions on user session directories so only the owning user account can create session files.

Patch Information

The maintainer was notified and the issue may be addressed in later builds, but no vulnerable version range was published. Track the upstream nnn project for a fixed release and rebuild or repackage from source once a patched commit is available. Until a versioned fix is confirmed, treat all nnn installations at or below version 5.2 as vulnerable.

Workarounds

Do not launch nnn with the -s option until a patched build is deployed.
Remove or empty the session directory (for example, ~/.config/nnn/sessions/) to prevent accidental loading of attacker-planted files.
Enforce filesystem permissions of 0700 on the user configuration directory to block cross-user file placement on multi-user hosts.
Consider replacing nnn with an alternative file manager on shared systems until a fixed release is confirmed.

bash

# Configuration example: harden the nnn session directory
chmod 700 "${XDG_CONFIG_HOME:-$HOME/.config}/nnn"
chmod 700 "${XDG_CONFIG_HOME:-$HOME/.config}/nnn/sessions" 2>/dev/null
find "${XDG_CONFIG_HOME:-$HOME/.config}/nnn/sessions" -type f -newer /etc/hostname -print