CVE-2026-8997

MediumCVSS 4.8

Published: 22/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

vifm is vulnerable to a heap buffer overflow during history merge when saving the state file (vifminfo.json). Lack of runtime length check on history entries in release builds can allow a crafted long path or command to cause memory corruption or crashes. Versions 0.12.1 to 0.14.3 are vulnerable.

Risk Assessment

Risk includes potential memory corruption and application crashes, which can disrupt user activity and lead to data loss.

Recommendation

Update vifm to a version containing the fix (commit 23063c7) or later.

Other vulnerabilities in vifm

CVE-2026-110237High
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.

Original NVD description (English source)

vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7

Vulnerability data from NVD (NIST) · CISA KEV · EPSS