This vulnerability involves an externally-controlled format string in the nano text editor on Red Hat Enterprise Linux 10. Specifically, when nano attempts to display directory names containing printf format specifiers in its statusline() function, it can trigger a segmentation fault. This flaw allows a local user to cause a denial of service by crashing the nano application. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

The impact is a denial of service condition caused by crashing the nano text editor when it processes directory names with malicious format specifiers. There is no indication of confidentiality or integrity compromise. The vulnerability requires local user access and user interaction to trigger. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. At this time, no official fix or patch has been published by Red Hat. Users should monitor the Red Hat advisory page for updates. Until a fix is available, avoid opening directories with untrusted or suspicious names containing format specifiers in nano.