nnn uses an unsigned char (uchar_t) type for the homelen variable, limiting it to values between 0 and 255. When an attacker controls the HOME environment variable with a length exceeding this range, the length is truncated, and the expression (homelen - 1) is promoted to a signed integer, becoming -1. This leads to an out-of-bounds read and write one byte before the allocated path buffer. The vulnerability was confirmed in version 5.2, but no explicit affected version range or patch information is available from the maintainer.

An attacker able to influence the victim's execution environment can cause out-of-bounds memory access, including one byte before the path buffer. This may lead to memory corruption, potentially causing crashes or undefined behavior. The severity is rated low, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or version range has been provided by the maintainer, users should monitor for updates from the project and consider avoiding version 5.2 until a fix is released.