CVE-2026-6843

CVE-2026-6843 is a format string vulnerability affecting the nano text editor, specifically in the statusline() function. An attacker can exploit this flaw by creating a directory with a name containing printf format specifiers, which causes nano to crash when attempting to display the directory name. The vulnerability results in a denial of service condition affecting the application. The vulnerability has a CVSS v3.1 score of 5.5 (MEDIUM severity) with a local attack vector requiring no privileges but user interaction. While the attack complexity is low, the impact is limited to availability—there is no impact to confidentiality or integrity. The EPSS score of 0.00013 indicates minimal real-world exploitation probability relative to other CVEs. There is no evidence of active exploitation at this time. The vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog, and it remains inactive on threat intelligence hot lists. Community attention appears limited, suggesting this is a lower-priority issue suitable for standard patching cycles rather than emergency remediation.