CVE-2026-121549

Medium CVSS 4.4

Published 2026-11-03 · last changed 2026-11-03

The fix

We hold no Microsoft remediation data for CVE-2026-121549, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

Sources

NVD record for CVE-2026-121549

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N