CVE-2026-65610: nnn File Manager Buffer Overflow Vulnerability

CVE-2026-65610 Overview

CVE-2026-65610 is a numeric truncation vulnerability in the nnn terminal file manager. The flaw resides in how nnn stores the homelen variable using the uchar_t type, which is limited to values between 0 and 255. An attacker who controls the victim's execution environment can supply an oversized HOME path whose length truncates to 0. The expression (homelen - 1) is then promoted to a signed integer and evaluates to -1, producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer. Version 5.2 was tested and confirmed vulnerable. This issue is tracked under [CWE-197: Numeric Truncation Error].

Critical Impact
Local attackers who can influence the HOME environment variable can trigger out-of-bounds memory access in nnn, potentially leading to crashes or limited memory corruption.

Affected Products

nnn file manager version 5.2 (confirmed vulnerable)
Earlier versions may also be affected; the maintainer did not publish a vulnerable version range
Systems where users invoke nnn with an attacker-controlled HOME variable

Discovery Timeline

2026-08-19 - CVE-2026-65610 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-65610

Vulnerability Analysis

The nnn file manager records the length of the HOME environment path in a variable named homelen. The variable is declared as uchar_t, an unsigned 8-bit integer that can only store values in the range 0 to 255. When a caller supplies a HOME path with a length that is a multiple of 256, the stored value wraps to 0.

The program later computes (homelen - 1) to index into the path buffer. Because C promotes the unsigned char to a signed integer for arithmetic, the result becomes -1 rather than a large unsigned value. Using -1 as an index produces both an out-of-bounds read and an out-of-bounds write one byte before the start of the buffer.

Exploitation requires local access and the ability to influence the victim's environment. Impact is bounded to a single byte written outside the buffer, which limits the practical severity but still constitutes memory corruption.

Root Cause

The root cause is improper type selection for a length value. Using uchar_t to store a path length that can legitimately exceed 255 bytes introduces a truncation error. The downstream arithmetic (homelen - 1) compounds the flaw by producing a negative signed index when the truncated value is 0.

Attack Vector

An attacker with local access sets the HOME environment variable to a path whose length is a multiple of 256 before launching nnn. When the file manager stores the length, it wraps to 0. Subsequent indexing with (homelen - 1) reads and writes one byte outside the intended buffer.

See the CERT Poland advisory for additional technical context. No public exploit or proof-of-concept has been published for this CVE at the time of writing.

Detection Methods for CVE-2026-65610

Indicators of Compromise

Unexpected crashes or segmentation faults reported by nnn processes launched by end users
Shell profiles or scripts that set HOME to an unusually long path prior to invoking nnn
Core dumps referencing addresses immediately preceding the nnn path buffer

Detection Strategies

Audit process launches of nnn and record the resolved HOME environment variable length at execution time
Alert when the HOME value exceeds typical filesystem path limits or is exactly a multiple of 256 bytes
Review shell initialization files (.bashrc, .zshrc, .profile) for unauthorized modifications to HOME

Monitoring Recommendations

Log environment variable state for interactive terminal sessions where nnn is commonly used
Monitor for signal 11 (SIGSEGV) terminations of the nnn binary across managed Linux endpoints
Track EPSS scoring updates for CVE-2026-65610 (currently 0.123%) to detect changes in exploitation likelihood

How to Mitigate CVE-2026-65610

Immediate Actions Required

Upgrade nnn to the latest upstream release once the maintainer confirms a fixed version
Restrict who can modify shell initialization files and system-wide environment defaults
Advise users not to run nnn in shells inherited from untrusted processes or scripts

Patch Information

The maintainer of nnn was notified of this vulnerability. A specific patched version range has not been published. Administrators should track the upstream repository and apply updates once a fixed release is available. Version 5.2 is the only version tested and confirmed vulnerable.

Workarounds

Sanitize the HOME environment variable in shell profiles to ensure it points to a normal path under 255 bytes
Avoid launching nnn from processes or session managers that permit arbitrary environment injection
Consider substituting an alternative terminal file manager on multi-user systems until an upstream fix is available

bash

# Configuration example: validate HOME length before launching nnn
if [ "${#HOME}" -ge 255 ] || [ "${#HOME}" -eq 0 ]; then
    echo "Refusing to launch nnn: HOME length ${#HOME} is unsafe" >&2
    exit 1
fi
exec nnn "$@"