Bug 2480738 (CVE-2026-8997)

Summary: CVE-2026-8997 vifm: vifm: Memory corruption and application crash due to heap buffer overflow.
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in vifm, a file manager. This vulnerability, a heap buffer overflow, occurs when the application saves its state file (vifminfo.json) during the history merge process. A local user could exploit this by introducing a specially crafted, excessively long path or command into the history. This lack of proper length validation can lead to memory corruption, potentially causing the application to crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2481426    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-22 14:01:28 UTC 
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes.
Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7