The vulnerability is an unsanitized format validation bug that permits a locally authenticated user to execute arbitrary commands with superuser privileges, resulting in a local privilege escalation. The flaw is a classic format‑string exploit (CWE‑134) that allows the attacker to control how data is interpreted during a validation routine.

The affected product is Nokia SR Linux. No specific firmware or package version data is included in the advisory, so any deployment of Nokia SR Linux that contains the vulnerable code is at risk.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1% implies a low likelihood of exploitation in the wild. The vulnerability requires local authentication, meaning an attacker must already have network or console access to the device. While it is not listed in the CISA KEV catalog, the potential to gain root access can lead to full compromise of the device, including data confidentiality, integrity, and availability. Due to the local nature of the attack vector, the risk is mitigated by network segmentation and strict access controls, but a patch is strongly recommended when available.