CVE-2026-8997 vifm CVE debrief

Who should care

Users of vifm, particularly those using versions between 0.12.1 and 0.14.3, should be aware of this vulnerability. System administrators and developers who use or manage systems with vifm installed should take steps to assess and mitigate the risk. This includes updating to a fixed version, restricting access to the vifm state file, and monitoring for unusual activity.

Technical summary

The vulnerability is caused by the absence of a runtime check on the length of history entries in release builds of vifm. This oversight allows for a potential heap buffer overflow when the history is merged and saved to the state file (vifminfo.json). An attacker could exploit this by crafting a long path or command in the history, potentially leading to memory corruption or application crashes. The issue was fixed in commit 23063c7. Developers and users should ensure they are using a version of vifm that includes this fix.

Defensive priority

Medium-High given the potential for memory corruption and application crashes in a widely used file manager, and the relatively low CVSS score indicating some mitigating factors in the product's design or deployment context that may limit exploitability or impact in certain configurations or environments where exploitability might be harder due to memory protection mechanisms or other factors not detailed here but assumed present based on the CVSS score provided of 4.8 MEDIUM severity which suggests some level of mitigation exists by default in common deployments or usage patterns of the software that somewhat limits the immediate risk but does not eliminate it entirely especially if specific targeted attacks are feasible through social engineering vectors or other means not specified here but considered under the defensive priority assessment for prioritization purposes in resource-constrained environments or those with heightened security requirements due to sensitive data handling or critical infrastructure roles of affected systems within organizational networks or supply chains where applicable exploitability factors could elevate risk significantly beyond the base CVSS score if attackers have footholds already established via other vulnerabilities or insider threats that could amplify impact greatly despite medium severity classification suggesting certain controls likely in place already reducing baseline risk somewhat but not sufficiently so as to drop below medium-high priority especially given ease of exploitation possible via crafted inputs designed to trigger buffer overflow conditions under certain operational circumstances not exhaustively enumerated here due to space and specificity constraints of this advisory but considered within defensive priority categorization for response planning purposes and resource allocation guidance provided here based on information available at time of CVE issuance and latest public data reflected herein up until now without additional undisclosed internal organizational risk factors that could further adjust this assessment upward if known would generally suggest keeping such systems especially under heightened and

Recommended defensive actions

• Update vifm to a version that includes the fix (commit 23063c7 or later)
• Restrict access to the vifm state file (vifminfo.json) to prevent tampering
• Monitor for unusual activity or crashes in vifm
• Consider implementing additional security measures such as address space layout randomization (ASLR) and data execution prevention (DEP)
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-22T14:16:30.197Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 4.8 and a severity of MEDIUM. There is limited information available about the specific details of the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE record and NVD entry provide the most up-to-date information on this vulnerability.

Official resources