The flaw is a numeric truncation error in the nnn application. The homelen variable is stored as an unsigned char and can hold only up to 255. An attacker can supply a HOME path longer than 255, causing homelen to truncate to 0. When the expression (homelen - 1) is evaluated, integer promotion makes it -1, leading to an out-of-bounds read and a write one byte before the allocated buffer, which corrupts adjacent memory.

The vulnerability has been confirmed only in version 5.2 of nnn. The maintainer was notified but has not published a fixed version range, and no other versions are known to be unaffected. Therefore, only version 5.2 is definitively vulnerable, and other unpatched releases may also contain the same flaw until further information is released.

The CVSS score of 2.4 indicates low severity. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, so widespread exploitation is unlikely. Based on the description, it is inferred that the attacker must have control over the environment in which nnn runs to supply a long HOME path, meaning local or privileged execution is required. Because the flaw depends on the supply of a specific environment variable and has a low severity, the overall risk is low but should still be mitigated if the affected version is in use.