CVE-2026-8997

vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/05/CVE-2026-8997
https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d

Configurations

No configuration.

History

23 Jul 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) vifm es vulnerable a un desbordamiento de búfer en el heap durante el proceso de fusión del historial al guardar el archivo de estado (vifminfo.json). Esta falla ocurre porque la aplicación carece de una verificación en tiempo de ejecución de la longitud de las entradas del historial en las compilaciones de lanzamiento, lo que podría permitir que una ruta o comando largo y malintencionado en el historial cause corrupción de memoria o fallos de la aplicación. Las versiones desde la 0.12.1 hasta la 0.14.3 (inclusive) se consideran vulnerables. Este problema se solucionó en el commit 23063c7

22 May 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-22 14:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-8997

Mitre link : CVE-2026-8997

CVE.ORG link : CVE-2026-8997

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-8997", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8997", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T15:03:15.382556Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/vifm/vifm/", "vendor": "vifm", "product": "vifm", "versions": [{"status": "affected", "version": "0.12.1", "versionType": "semver", "lessThanOrEqual": "0.14.3"}], "programFiles": ["src/utils/trie.c"], "defaultStatus": "unaffected"}]}], "published": "2026-05-22T14:16:30.197", "references": [{"url": "https://cert.pl/en/posts/2026/05/CVE-2026-8997", "source": "cvd@cert.pl"}, {"url": "https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.\nReleases from 0.12.1 to\u00a00.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7"}, {"lang": "es", "value": "vifm es vulnerable a un desbordamiento de b\u00fafer en el heap durante el proceso de fusi\u00f3n del historial al guardar el archivo de estado (vifminfo.json). Esta falla ocurre porque la aplicaci\u00f3n carece de una verificaci\u00f3n en tiempo de ejecuci\u00f3n de la longitud de las entradas del historial en las compilaciones de lanzamiento, lo que podr\u00eda permitir que una ruta o comando largo y malintencionado en el historial cause corrupci\u00f3n de memoria o fallos de la aplicaci\u00f3n.\nLas versiones desde la 0.12.1 hasta la 0.14.3 (inclusive) se consideran vulnerables. Este problema se solucion\u00f3 en el commit 23063c7"}], "lastModified": "2026-07-23T16:10:00.137", "sourceIdentifier": "cvd@cert.pl"}