CVE-2025-13566CWE-119CWE-415

CVE-2025-13566

Low · published November 24, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of the file nnn/src/nnn.c. The manipulation leads to double free. An attack has to be approached locally. The identifier of the patch is 2f07ccdf21e705377862e5f9dfa31e1694979ac7. It is suggested to install a patch to address this issue.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00133 · 2.6th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-415 · Double Free
Published
2025-11-24T01:15Z
References (6)
https://github.com/jarun/nnn/commit/2f07ccdf21e705377862e5f9dfa31e1694979ac7 · [email protected]https://github.com/jarun/nnn/issues/2091#issue-3635886658 · [email protected]https://github.com/jarun/nnn/issues/2091#issuecomment-3547591759 · [email protected]https://vuldb.com/?ctiid.333330 · [email protected]https://vuldb.com/?id.333330 · [email protected]https://vuldb.com/?submit.698113 · [email protected]
EPSS history
Timeline
  • 23 NOV 19:32Z
    jarun nnn nnn.c run_cmd_as_plugin double free
    cvelistv5