CVE-2026-65609— Arun Prakash Jana nnn 缓冲区错误漏洞

Out-of-bounds write in nnn

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious session file in the victim's nnn session directory can exploit this to corrupt adjacent global state. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

跨界内存写

Arun Prakash Jana nnn 缓冲区错误漏洞

Arun Prakash Jana nnn是Arun Prakash Jana个人开发者开源的一个用 C 语言编写的便携式终端文件管理器。 Arun Prakash Jana nnn 5.2版本存在缓冲区错误漏洞，该漏洞源于缺少对从会话文件反序列化的攻击者控制长度字段的验证，可能导致越界写入并破坏相邻全局状态。

N/A

N/A