Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110237Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

High 7.3

In plain English

A high-severity security flaw in vifm from vifm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vifmno fix listedDEBIAN-CVE-2026-110237
Debian:13vifmno fix listedDEBIAN-CVE-2026-110237
Debian:14vifm0.14.5-1DEBIAN-CVE-2026-110237
Ubuntu:22.04:LTSvifmno fix listedUBUNTU-CVE-2026-110237
Ubuntu:24.04:LTSvifmno fix listedUBUNTU-CVE-2026-110237
Ubuntu:26.04:LTSvifmno fix listedUBUNTU-CVE-2026-110237
Ubuntu:26.10vifmno fix listedUBUNTU-CVE-2026-110237

Affected products (as reported)

VendorProductVersions
vifm vifm 0.8.1-beta – through 0.14.4

Weakness: CWE-283 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References