The nnn text‑based file manager contains an out‑of‑bounds write bug triggered when deserializing session files that the application loads with the -s flag. A crafted session file can cause nnn to write beyond the end of a fixed‑size global buffer, corrupting adjacent memory structures. The vulnerability only affects the integrity of the running process and can lead to a crash or unpredictable behaviour, but there is no evidence of code‑execution or information‑exposure from the description.

The affected product is the nnn application, specifically version 5.2, which has been confirmed vulnerable by internal testing. No explicit vulnerable‑version range was provided by the maintainer, so it is unknown whether earlier or later releases are affected. The maintainer has been notified and is working on a fix; a non‑vulnerable release has not yet been identified.

The flaw requires an attacker to supply a malicious session file to the nnn session directory, meaning local access or control over file placement is necessary. The EPSS score of < 1% indicates a very low probability of exploitation, aligning with the low CVSS score of 2.4. The vulnerability is not present in the CISA KEV list. Overall, the risk is modest. Proper file‑system permissions or disabling the -s option can mitigate the attack surface, and applying an official patch or upgrade once available is the most effective defense.