Local memory corruption via unchecked session lengths

Out-of-bounds write in session loading in Arun Prakash Jana nnn 5.2 allows local users to corrupt process memory via a crafted session file. When nnn loads a named session with the -s option, it deserializes attacker-controlled length fields from the session file without validating them against fixed-size global buffers, so later writes run past buffer ends into adjacent global variables. Exploitation requires placement of a malicious session file in the victim's nnn session directory and user interaction to load it; published records describe state corruption and unpredictable behavior, with no public evidence of code execution or data disclosure.