A local user can trigger a segmentation fault in the nano editor by creating a directory whose name contains printf format specifiers. The vulnerable statusline() function attempts to display the directory name without proper sanitization, causing nano to crash. The resulting denial of service is confined to the instance of the nano application and does not compromise system integrity or confidentiality directly.

The flaw affects Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat OpenShift Container Platform 4. Users running the nano editor on these platforms are potentially exposed.

The CVSS score of 5.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local user access and involves a directory name crafted with format specifiers. Exploitation results in a graceful crash of the nano process, effectively denying its use until a restart or mitigate step is taken.