Vulnerability · Published May 22, 2026 · Assigned by CERT-PL
CVE-2026-8997Heap Buffer Overflow in vifm
Medium 4.8
In plain English
A medium-severity heap buffer overflow in vifm from vifm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | vifm | no fix listed | DEBIAN-CVE-2026-8997 |
| Debian:13 | vifm | no fix listed | DEBIAN-CVE-2026-8997 |
| Debian:14 | vifm | 0.14.3-3 | DEBIAN-CVE-2026-8997 |
| Ubuntu:22.04:LTS | vifm | no fix listed | UBUNTU-CVE-2026-8997 |
| Ubuntu:24.04:LTS | vifm | no fix listed | UBUNTU-CVE-2026-8997 |
| Ubuntu:25.10 | vifm | no fix listed | UBUNTU-CVE-2026-8997 |
| Ubuntu:26.04:LTS | vifm | no fix listed | UBUNTU-CVE-2026-8997 |
| Ubuntu:26.10 | vifm | no fix listed | UBUNTU-CVE-2026-8997 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N