Cyber Resilience

CVE-2026-6843

Redhat Enterprise Linux 10.0 … 9.0

Published
22 April 2026
Modified
20 May 2026
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0011 1th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-6843 is a medium-severity Use of Externally-Controlled Format String (CWE-134) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-7 (Least Functionality) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation…

more

fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.

CWE(s)
CWE-134

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Format string vuln in nano directly enables local application crash via crafted input (directory name), matching Application or System Exploitation for DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1499.004 Application or System Exploitation Impactconfidence: HIGH
Format string flaw in statusline() directly enables local exploitation to crash the nano process via crafted directory name.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-32990Same product: Redhat Enterprise Linux
CVE-2026-6844Same product: Redhat Enterprise Linux
CVE-2026-6845Same product: Redhat Enterprise Linux
CVE-2026-3442Same product: Redhat Enterprise Linux
CVE-2024-5742Same product: Gnu Nano
CVE-2026-42009Same product: Redhat Enterprise Linux
CVE-2025-0678Same product: Redhat Enterprise Linux
CVE-2026-1584Same vendor: Gnu
CVE-2025-32988Same product: Redhat Enterprise Linux
CVE-2026-4647Same product: Redhat Enterprise Linux

Affected Assets

gnu
nano
8.7
redhat
openshift container platform
4.0
redhat
enterprise linux
10.0, 6.0, 7.0, 8.0, 9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • SI-7 Software, Firmware, and Information Integrity
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires applying patches or updates to remediate the format-string flaw in nano before a local user can trigger the SEGV via a crafted directory name.

SI-7 Software, Firmware, and Information Integrity partial match
preventdetect

Verifies integrity of the nano binary and its runtime behavior, blocking or alerting on execution of the vulnerable version that mishandles directory-name input.

CM-7 Least Functionality partial match
prevent

Disables or restricts nano (least functionality) on systems where the vulnerable statusline() code cannot be immediately replaced, eliminating the attack surface for this DoS.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent external format strings via code review, static analysis, and safe APIs.

ID.RA-01 partial match
prevents

Vulnerability identification can discover existing format-string flaws but does not prevent their introduction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect format-string vulnerabilities before release.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates input validation and safe API usage that can prevent externally-controlled format strings.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify safe formatting functions and ban uncontrolled format strings.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles discourage dangerous string-handling patterns that lead to format-string issues.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly forbid the use of untrusted format strings and prescribe safe alternatives.

References