{
  "cveId": "CVE-2026-40556",
  "url": "https://patchblox.com/security/cve/CVE-2026-40556",
  "summary": "CVE-2026-40556 is fixed in nano on 1 platform, first by DEBIAN-CVE-2026-40556, released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "nano vulnerability",
  "description": "This update for nano fixes the following issues:\n\nChanges in nano:\n\n- Update to version 9.1:\n  * When searching, the viewport is placed snug left where\n    possible.\n  * The ability to read and write files in old Mac format (a lone\n    carriage return as line ending) was removed.\n  * The ^T toggle between WhereIs and GotoLine was dropped.\n  * Fix backups that were missing or had a wrong timestamp when\n    --backup is active.\n  * On a crash or kill, a .save file is no longer chmodded or\n    chowned to the base file\u0027s permissions and owner.\n  * The history code now creates the ~/.local directory with\n    limited access rights (boo#1263437; the referenced\n    CVE-2026-40556 was rejected upstream).\n  * M-Ins and M-Del have become rebindable.\n\n- GNU nano 9.0:\n  * When the cursor almost goes offscreen to the right, all lines\n    are now scrolled sideways together, by just the amount needed\n    to keep the cursor in view.\n    Use --solosidescroll or \u0027set solosidescroll\u0027 to get back the\n    old, jerky, single-line horizontal scrolling.\n  * The viewport can be scrolled sideways (in steps of one\n    tabsize) with M-\u003C and M-\u003E.  See \u0060man nanorc\u0060 if M-\u003C and M-\u003E\n    should switch between buffers (as they did earlier).\n  * M-Left, M-Right, M-Up, and M-Down have become rebindable.\n  * Stopping the recording of a macro immediately after starting\n    it cancels the recording and leaves an existing macro in place.\n  * Feature toggles no longer break a chain of ^K cuts or M-6\n    copies, except the M-K cut-from-cursor toggle.\n  * With --mouse and --indicator, one can click in the scrollbar\n    area to roughly navigate within the buffer.\n  * CVE-2026-6843: format string vulnerability leads to denial of\n    service (boo#1262643)\n  * create the ~/.local directory with limited access rights\n    (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)\n\n- GNU nano 8.7.1:\n  * fix build against glibc-2.43 (boo#1258260)\n\n- GNU nano 8.7:\n  * At the Execute prompt, preceding the command with two pipe\n    symbols allows implementing a copy-to-clipboard feature in\n    nanorc on terminals that support OSC 52. See doc/sample.nanorc",
  "published": "2026-04-28T15:16:30Z",
  "severity": "",
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "nano",
      "release": "Debian 14",
      "fixedVersion": "9.0-1",
      "fix": "DEBIAN-CVE-2026-40556",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40556",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "nano",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "9.1-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21166-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21166-1",
      "released": "2026-06-29T08:14:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}