Vulnerabilidades do Vifm Vifm
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Vifm Vifm: 2 registro(s), com versões afetadas e correções.
CVE-2026-110237
Alta · 7.3
CWE-283 13/10/2026
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
CVE-2026-8997
Média · 4.8
CWE-122 22/05/2026
Heap Buffer Overflow in vifm
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.
Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7