Heap Buffer Overflow in Vifm Product by Vifm
CVE-2026-8997

4.8MEDIUM

Key Information:

Vendor

Vifm

Status
Vifm
Vendor
CVE Published:
22 May 2026

What is CVE-2026-8997?

Vifm is affected by a heap buffer overflow caused by improper handling of history entries during the state file saving process. This vulnerability allows for crafted long paths or commands to be used in history, potentially leading to memory corruption or application crashes. Affected releases include versions from 0.12.1 to 0.14.3, with the issue resolved in a recent commit. Users are advised to update their software to ensure safety.

Affected Version(s)

vifm 0.12.1 <= 0.14.3

References

https://cert.pl/en/posts/2026/05/CVE-2026-8997
third-party-advisory
https://github.com/vifm/vifm/commit/23063c741f15a85621fd2...
patch

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE)
Marcin Wyczechowski (AFINE)
.