NRSS RSS Reader 0.3.9-1 includes a stack buffer overflow that can be triggered by a local user supplying an oversized argument to the -F parameter. The flaw allows overwriting the return address on the stack, enabling arbitrary code execution. The vulnerability is classified as CWE-787, indicating a buffer overrun that corrupts adjacent memory.

The affected product is NRSS Reader produced by the NRSS vendor. Only version 0.3.9-1 is listed as vulnerable; no other vendors or product versions are referenced in the advisory.

The CVSS score of 8.6 signals high severity, while an EPSS score below 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to the machine running NRSS and the ability to provide a crafted -F argument; no remote or authenticated network access is described.