Search
Find a vulnerability
Search criteria
2 vulnerabilities by vifm
CVE-2026-110237 (GCVE-0-2026-110237)
Vulnerability from nvd – Published: 2026-10-13 18:50 – Updated: 2026-10-17 00:38
VLAI
EPSS
VEX
Title
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Summary
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 00:38 UTC
CWE
- CWE-283 - Unverified Ownership
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg | third-party-advisory |
| https://github.com/vifm/vifm/blob/v0.14.4/src/ipc… | technical-description |
| https://github.com/vifm/vifm/blob/v0.14.4/src/ipc… | technical-description |
| https://github.com/vifm/vifm/releases/tag/v0.14.4 | release-notes |
| https://www.vulncheck.com/advisories/vifm-0.8.1-b… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-17T00:38:40.926530Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T00:38:50.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vifm",
"repo": "https://github.com/vifm/vifm",
"vendor": "vifm",
"versions": [
{
"lessThanOrEqual": "0.14.4",
"status": "affected",
"version": "0.8.1-beta",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim\u0027s privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-283",
"description": "Unverified Ownership",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:18.056Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/vifm/vifm/blob/v0.14.4/src/ipc.c#L394-L443"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/vifm/vifm/blob/v0.14.4/src/ipc.c#L866-L874"
},
{
"name": "v0.14.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/vifm/vifm/releases/tag/v0.14.4"
},
{
"name": "VulnCheck Advisory: Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vifm-0.8.1-beta-through-0.14.4-unverified-ipc-fifo-ownership-allows-cross-user-command-execution"
}
],
"title": "Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110237",
"datePublished": "2026-10-13T18:50:18.056Z",
"dateReserved": "2026-10-13T18:00:07.859Z",
"dateUpdated": "2026-10-17T00:38:50.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8997 (GCVE-0-2026-8997)
Vulnerability from nvd – Published: 2026-05-22 13:26 – Updated: 2026-05-22 15:03 X_Open Source
VLAI
EPSS
VEX
Title
Heap Buffer Overflow in vifm
Summary
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.
Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-22 15:03 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/05/CVE-2026-8997 | third-party-advisory |
| https://github.com/vifm/vifm/commit/23063c741f15a… | patch |
Date Public
2026-05-22 12:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8997",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-22T15:03:15.382556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T15:03:29.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vifm",
"programFiles": [
"src/utils/trie.c"
],
"repo": "https://github.com/vifm/vifm/",
"vendor": "vifm",
"versions": [
{
"lessThanOrEqual": "0.14.3",
"status": "affected",
"version": "0.12.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Majchrowicz (AFINE)"
},
{
"lang": "en",
"type": "finder",
"value": "Marcin Wyczechowski (AFINE)"
}
],
"datePublic": "2026-05-22T12:56:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.\u003cbr\u003eReleases from 0.12.1 to\u0026nbsp;0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7\u003cbr\u003e"
}
],
"value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.\nReleases from 0.12.1 to\u00a00.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T13:26:17.904Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/05/CVE-2026-8997"
},
{
"tags": [
"patch"
],
"url": "https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Heap Buffer Overflow in vifm",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-8997",
"datePublished": "2026-05-22T13:26:17.904Z",
"dateReserved": "2026-05-19T13:33:16.963Z",
"dateUpdated": "2026-05-22T15:03:29.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}