CVE-2026-121550

Low CVSS 3.3

Published 2026-11-03 · last changed 2026-11-03

The fix

We hold no Microsoft remediation data for CVE-2026-121550, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.

Sources

NVD record for CVE-2026-121550

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N