The flaw lies in GNU nano’s multi‑buffer error message handling. When a user starts nano with multiple files, an ALERT‑level error from one file can trigger a format string vulnerability. A specially crafted filename containing printf format specifiers (e.g., %s, %p, %n) is reinterpreted by the error handler, allowing an attacker to read stack data, crash the process, or potentially write arbitrary data to memory. No remote code execution is explicitly stated, but the possibility of arbitrary memory writes indicates a severe confidentiality, integrity, or availability risk.

Affected platforms include Red Hat Enterprise Linux 10, 6, 7, 8, 9 and Red Hat OpenShift Container Platform 4. The precise affected nano versions are not specified; any currently deployed instance of GNU nano on these systems could be vulnerable unless a fixed release is applied.

The CVSS score of 6.8 labels the vulnerability as moderate. The EPSS score of less than 1 % indicates a very low, but non‑zero, likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attack requires a specially crafted file name and an alert‑level error during multi‑buffer startup, implying a local‑or‑non‑privileged attacker who can influence the file list or provide an untrusted file. Although the risk is moderate, the potential for memory corruption warrants careful attention.