Cyber News / Article / Vulnerability in vifm software
Vulnerability in vifm software
CERT Polska has received a report about vulnerability in vifm software and participated in coordination of its disclosure.
The vulnerabilityCVE-2026-8997: vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.
Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit23063c7
We thank MichaÅ Majchrowicz and Marcin Wyczechowski from AFINE for the responsible vulnerability report.
Related articles
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data
8 days ago
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
9 days ago
SAP Patches Critical Extended Passport Processing Vulnerability
3 days ago
You might Also like
Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
