CVE-2026-8997

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8997", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-05-19T13:33:16.963Z", "datePublished": "2026-05-22T13:26:17.904Z", "dateUpdated": "2026-05-22T15:03:29.811Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "vifm", "programFiles": ["src/utils/trie.c"], "repo": "https://github.com/vifm/vifm/", "vendor": "vifm", "versions": [{"lessThanOrEqual": "0.14.3", "status": "affected", "version": "0.12.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE)"}], "datePublic": "2026-05-22T12:56:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.<br>Releases from 0.12.1 to&nbsp;0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7<br>"}], "value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.\nReleases from 0.12.1 to\u00a00.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 4.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-05-22T13:26:17.904Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/05/CVE-2026-8997"}, {"tags": ["patch"], "url": "https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d"}], "source": {"discovery": "EXTERNAL"}, "tags": ["x_open-source"], "title": "Heap Buffer Overflow in vifm", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-22T15:03:15.382556Z", "id": "CVE-2026-8997", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T15:03:29.811Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8997", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T15:03:15.382556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T15:03:24.979Z"}}], "cna": {"tags": ["x_open-source"], "title": "Heap Buffer Overflow in vifm", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/vifm/vifm/", "vendor": "vifm", "product": "vifm", "versions": [{"status": "affected", "version": "0.12.1", "versionType": "semver", "lessThanOrEqual": "0.14.3"}], "programFiles": ["src/utils/trie.c"], "defaultStatus": "unaffected"}], "datePublic": "2026-05-22T12:56:00.000Z", "references": [{"url": "https://cert.pl/en/posts/2026/05/CVE-2026-8997", "tags": ["third-party-advisory"]}, {"url": "https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.\nReleases from 0.12.1 to\u00a00.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7", "supportingMedia": [{"type": "text/html", "value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.<br>Releases from 0.12.1 to&nbsp;0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-05-22T13:26:17.904Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8997", "state": "PUBLISHED", "dateUpdated": "2026-05-22T15:03:29.811Z", "dateReserved": "2026-05-19T13:33:16.963Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-05-22T13:26:17.904Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "vifm", "programFiles": ["src/utils/trie.c"], "repo": "https://github.com/vifm/vifm/", "vendor": "vifm", "versions": [{"lessThanOrEqual": "0.14.3", "status": "affected", "version": "0.12.1", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.\nReleases from 0.12.1 to\u00a00.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7"}, {"lang": "es", "value": "vifm es vulnerable a un desbordamiento de b\u00fafer en el heap durante el proceso de fusi\u00f3n del historial al guardar el archivo de estado (vifminfo.json). Esta falla ocurre porque la aplicaci\u00f3n carece de una verificaci\u00f3n en tiempo de ejecuci\u00f3n de la longitud de las entradas del historial en las compilaciones de lanzamiento, lo que podr\u00eda permitir que una ruta o comando largo y malintencionado en el historial cause corrupci\u00f3n de memoria o fallos de la aplicaci\u00f3n.\nLas versiones desde la 0.12.1 hasta la 0.14.3 (inclusive) se consideran vulnerables. Este problema se solucion\u00f3 en el commit 23063c7"}], "id": "CVE-2026-8997", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8997", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-22T15:03:15.382556Z", "version": "2.0.3"}}]}, "published": "2026-05-22T14:16:30.197", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/05/CVE-2026-8997"}, {"source": "cvd@cert.pl", "url": "https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.12.1,0.14.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "vifm", "vendor": "vifm"}], "created": "2026-05-22T15:15:09.453767+00:00", "updated": "2026-05-25T11:34:20.286857+00:00", "vendors": ["vifm", "vifm$PRODUCT$vifm"]}