What is CVE-2026-65610?
This vulnerability exists in the nnn file manager utility where the `homelen` variable is stored as `uchar_t`, limiting values to 0-255. An attacker controlling the victim's execution environment can provide an overly long `HOME` path, causing the length to be truncated to 0, making `(homelen - 1)` evaluate to -1, potentially leading to memory corruption.
Azərbaycanca: Bu zəiflik nnn fayl meneceri utilitində `homelen` dəyişəninin `uchar_t` kimi saxlanması ilə bağlıdır. Təcavüzkar qurbanın mühitində uzun `HOME` yolunu təmin edərək uzunluğu 0-a qədər kəsə bilər, nəticədə `(homelen - 1)` ifadəsi -1 olur və bu, potensial yaddaş korrupsiyasına səbəb ola bilər.
Related CVEs
link basis: same weakness class CWE-190
FAQ2
What is the CVE-2026-65610 vulnerability in the nnn file manager utility related to?
This vulnerability exists because the `homelen` variable is stored as `uchar_t`. An attacker controlling the victim's execution environment can provide an overly long `HOME` path, causing the length to be truncated to 0.
What can be the consequence of CVE-2026-65610?
When the length is truncated to 0, the `(homelen - 1)` expression evaluates to -1, potentially leading to memory corruption.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.