Medium
vifm — security advisory
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7
- Products
- vifm
- Affected versions
- 0.10.1-2, 0.10.1-3, 0.10.1-4, 0.12-1, 0.12-1build1, 0.12-1build2, 0.14-3, 0.14.3-1, 0.14.3-3, 0.14.4-1, 0.7.8-3, 0.7.8-3build1, 0.9-1, 0.9.1-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-8997
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:31 UTC · Revision 1
Source evidence
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7
osv:UBUNTU-CVE-2026-8997
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
vifm
Fixed versions: Not specified
Complete source record
{
"id": "71c8846817f0fb05b7186d31684f92a3c730c42a84d0e741f6eca9f631e86d6b",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-8997",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-8997",
"summary": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7",
"evidence": "osv:UBUNTU-CVE-2026-8997",
"products": [
{
"name": {
"value": "vifm",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.7.8-3",
"evidence": "/affected/0/versions"
},
{
"value": "0.7.8-3build1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.9.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.10.1-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.1-3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.10.1-4",
"evidence": "/affected/3/versions"
},
{
"value": "0.12-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.12-1",
"evidence": "/affected/4/versions"
},
{
"value": "0.12-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "0.12-1build2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.12-1build2",
"evidence": "/affected/5/versions"
},
{
"value": "0.14-3",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.14.3-1",
"evidence": "/affected/6/versions"
},
{
"value": "0.14.3-3",
"evidence": "/affected/6/versions"
},
{
"value": "0.14.4-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "vifm",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.14-3",
"evidence": "/affected/7/versions"
},
{
"value": "0.14.3-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-8997",
"aliases": [
"UBUNTU-CVE-2026-8997"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.7.8-3",
"0.7.8-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.7.8-3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.9-1",
"0.9.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.9.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.10.1-2",
"0.10.1-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.10.1-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.10.1-4",
"0.12-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.12-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.12-1",
"0.12-1build1",
"0.12-1build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.12-1build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.12-1build2",
"0.14-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.14-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.14.3-1",
"0.14.3-3",
"0.14.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.14.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vifm",
"purl": "pkg:deb/ubuntu/vifm?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.14-3",
"0.14.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8997.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "vifm",
"binary_version": "0.14.3-1"
}
]
}
}
],
"modified": "2026-10-17T13:01:16.540965157Z",
"provider": "osv",
"upstream": [
"CVE-2026-8997"
],
"references": [
"https://ubuntu.com/security/CVE-2026-8997",
"https://www.cve.org/CVERecord?id=CVE-2026-8997",
"https://cert.pl/en/posts/2026/05/CVE-2026-8997",
"https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d"
]
},
"related_cves": [
{
"value": "CVE-2026-8997",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361456,
"published_at": "2026-05-22T14:16:00+00:00"
}