CVE-2026-65610

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65610", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-22T10:59:31.846Z", "datePublished": "2026-08-19T13:21:13.455Z", "dateUpdated": "2026-08-20T15:57:11.971Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-19T13:21:13.455Z"}, "title": "Numeric Truncation Error in nnn", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-197", "description": "CWE-197 Numeric truncation error", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "affected": [{"vendor": "nnn", "product": "nnn", "repo": "https://github.com/jarun/nnn", "versions": [{"status": "affected", "version": "5.2", "versionType": "git"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide\u00a0an arbitrary HOME path with length\u00a0that is truncated\u00a0to 0. The expression (homelen - 1) is promoted to signed int and\u00a0becomes -1 and producing an\u00a0out-of-bounds read and an out-of-bounds write one byte before the path buffer.\u00a0\n\n\n\n\nMaintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide&nbsp;an arbitrary HOME path with length<span>&nbsp;that is truncated</span><span>&nbsp;to 0. T</span><span>he expression (homelen - 1) is promoted to signed int and&nbsp;</span><span>becomes -1 and producing an&nbsp;</span><span>out-of-bounds read and an out-of-bounds write one byte before the path </span><span>buffer.&nbsp;</span><div><div><br></div></div><div>Maintainer of this project was notified about this vulnerability<span>. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.</span></div>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-65609", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T15:32:36.475854Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:57:11.971Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T15:32:36.475854Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:53:42.685Z"}}], "cna": {"tags": ["x_open-source"], "title": "Numeric Truncation Error in nnn", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/jarun/nnn", "vendor": "nnn", "product": "nnn", "versions": [{"status": "affected", "version": "5.2", "versionType": "git"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-65609", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide\u00a0an arbitrary HOME path with length\u00a0that is truncated\u00a0to 0. The expression (homelen - 1) is promoted to signed int and\u00a0becomes -1 and producing an\u00a0out-of-bounds read and an out-of-bounds write one byte before the path buffer.\u00a0\n\n\n\n\nMaintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.", "supportingMedia": [{"type": "text/html", "value": "nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide&nbsp;an arbitrary HOME path with length<span>&nbsp;that is truncated</span><span>&nbsp;to 0. T</span><span>he expression (homelen - 1) is promoted to signed int and&nbsp;</span><span>becomes -1 and producing an&nbsp;</span><span>out-of-bounds read and an out-of-bounds write one byte before the path </span><span>buffer.&nbsp;</span><div><div><br></div></div><div>Maintainer of this project was notified about this vulnerability<span>. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-197", "description": "CWE-197 Numeric truncation error"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-19T13:21:13.455Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65610", "state": "PUBLISHED", "dateUpdated": "2026-08-20T15:57:11.971Z", "dateReserved": "2026-07-22T10:59:31.846Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-08-19T13:21:13.455Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "nnn", "repo": "https://github.com/jarun/nnn", "vendor": "nnn", "versions": [{"status": "affected", "version": "5.2", "versionType": "git"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide\u00a0an arbitrary HOME path with length\u00a0that is truncated\u00a0to 0. The expression (homelen - 1) is promoted to signed int and\u00a0becomes -1 and producing an\u00a0out-of-bounds read and an out-of-bounds write one byte before the path buffer.\u00a0\n\n\n\n\nMaintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable."}, {"lang": "es", "value": "nnn almacena la variable homelen como uchar_t, que solo puede representar valores en el rango 0-255. Un atacante que puede influir en el entorno de ejecuci\u00f3n de la v\u00edctima puede proporcionar una ruta HOME arbitraria con una longitud que se trunca a 0. La expresi\u00f3n (homelen - 1) se promociona a int con signo y se convierte en -1, produciendo una lectura fuera de l\u00edmites y una escritura fuera de l\u00edmites un byte antes del b\u00fafer de la ruta.\n\nEl mantenedor de este proyecto fue notificado sobre esta vulnerabilidad. Podr\u00eda haber sido abordada, pero el mantenedor no proporcion\u00f3 un rango de versiones vulnerables. Solo la versi\u00f3n 5.2 fue probada y confirmada como vulnerable."}], "id": "CVE-2026-65610", "lastModified": "2026-10-27T12:10:00.343", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65610", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T15:32:36.475854Z", "version": "2.0.3"}}]}, "published": "2026-08-19T14:17:38.227", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/08/CVE-2026-65609"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-197"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nnn", "source": "cna", "vendor": "nnn"}, "product": "nnn", "vendor": "nnn"}], "created": "2026-08-19T18:45:03.681632+00:00", "updated": "2026-08-20T18:00:04.064632+00:00", "vendors": ["nnn", "nnn$PRODUCT$nnn"]}