This is a possible security issue which has already published to the public pan developer list, filed on Red Hat Bugzilla, and assigned a CVE number, so it's public.

CVE-2008-2363 but as of now all that gives me is "reserved".
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2363

From Pavel's post to the pan devel list:
<quote>I discovered a heap overflow in pan 0.132, part of the code reading .nzb 
files (either from tasks.nzb or elsewhere). Usually it results in 
assertion failure, but in certain cases might lead to segmentation 
fault, arbitrary code execution shouldn't be ruled out either.</quote>

There is a patch available.  See the Red Hat Bug entry, here:
https://bugzilla.redhat.com/show_bug.cgi?id=446902

The post to pan's dev list, courtesy gmane, here:
http://permalink.gmane.org/gmane.comp.gnome.apps.pan.devel/1077