CVE-2026-8997: Heap Buffer Overflow in vifm
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vifmto a version that resolves this vulnerability.Patch 23063c7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8997?
CVE-2026-8997 has a risk severity rating of 20.
How do I fix CVE-2026-8997?
To fix CVE-2026-8997, update to the latest version of vifm that addresses the heap buffer overflow vulnerability.
What conditions lead to exploitation of CVE-2026-8997?
CVE-2026-8997 can be exploited due to a lack of runtime checks on the length of history entries during the history merge process.
What type of vulnerability is CVE-2026-8997?
CVE-2026-8997 is categorized as a heap buffer overflow vulnerability.
In which software is CVE-2026-8997 found?
CVE-2026-8997 is found in the vifm software.