NRSS RSS Reader 0.3.9-1 includes a stack buffer overflow that can be triggered by passing an oversized value to the -F command‑line switch. The flaw allows an attacker to supply 256 bytes of padding followed by a crafted return‑address value, overwriting the function return pointer and enabling arbitrary code execution on the local machine.

The vulnerability affects NRSS Reader version 0.3.9-1. No other versions or products are listed as impacted.

The issue carries a CVSS score of 8.6, indicating high severity, but the EPSS score is below 1%, implying low likelihood of widespread exploitation. The vulnerability is not currently catalogued in the CISA KEV list. Exploitation requires local access and the ability to invoke the program with the -F parameter supplied by a malicious user.