CVE-2026-8997: vifm Heap Buffer Overflow Vulnerability

CVE-2026-8997 Overview

CVE-2026-8997 is a heap buffer overflow vulnerability in vifm, a console file manager with vi-like keybindings. The flaw occurs during the history merge process when the application saves its state file (vifminfo.json). Release builds lack a runtime length check on history entries, so a crafted long path or command stored in the history can corrupt heap memory or crash the application. The vulnerability affects releases from 0.12.1 through 0.14.3 inclusive and was fixed in commit 23063c7. The weakness is classified as [CWE-122] heap-based buffer overflow.

Critical Impact
A local attacker who can influence vifm's history entries can trigger heap memory corruption or denial of service when the state file is saved.

Affected Products

vifm 0.12.1 through 0.14.3 (inclusive)
Release builds without runtime length checks on history entries
The vifminfo.json state file save path through the trie implementation

Discovery Timeline

2026-05-22 - CVE-2026-8997 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-8997

Vulnerability Analysis

The vulnerability resides in vifm's trie implementation used during the history merge process. When vifm writes its persistent state to vifminfo.json, it merges in-memory history with existing on-disk history entries. The trie data structure used for this merge does not validate the length of incoming history entries in release builds.

When the merge logic copies an overly long path or command string into a fixed-size heap allocation, it writes past the allocated boundary. This corrupts adjacent heap metadata and chunks. The corruption can crash the process or, depending on heap layout, influence control flow in subsequent allocations.

Root Cause

The root cause is missing input validation on history entry length in release builds of vifm. Debug builds may include assertions, but those checks are compiled out in production binaries. The trie insertion code assumes well-formed bounded input and writes into a heap buffer sized for typical entries. Attacker-controlled history values exceeding that size produce the overflow described in [CWE-122].

Attack Vector

Exploitation requires local access and user interaction, since the attacker must place a crafted entry into vifm's history and then trigger a state save. This can occur when a user runs vifm in a directory or environment where another local user controls history sources, or when a malicious script writes oversized entries before vifm flushes its state.

text

// Patch reference from ChangeLog (commit 23063c7)
+	Fixed a buffer overflow in trie implementation.  Thanks to Michał
+	Majchrowicz and Marcin Wyczechowski.

Source: GitHub Vifm Commit Reference

Detection Methods for CVE-2026-8997

Indicators of Compromise

Unexpected crashes or aborts of the vifm process during shutdown or session save
Corrupted or truncated vifminfo.json files in user configuration directories
Abnormally long path or command strings present in vifm history files prior to a crash
Glibc heap diagnostic messages such as malloc(): corrupted originating from vifm

Detection Strategies

Inventory installed vifm binaries and flag any version between 0.12.1 and 0.14.3 inclusive
Monitor for repeated crash signals (SIGABRT, SIGSEGV) from vifm in system logs and core dump directories
Audit vifminfo.json and history sources for entries that exceed typical path or command length

Monitoring Recommendations

Forward process crash events and core dump notifications from Linux endpoints to a central log store for correlation
Track file integrity changes to ~/.config/vifm/vifminfo.json and related state files
Alert on writes to vifm history files by non-interactive processes or unexpected users

How to Mitigate CVE-2026-8997

Immediate Actions Required

Upgrade vifm to a build that includes commit 23063c741f15a85621fd232dfc3ac5b779f6910d or later
Identify all systems running vifm 0.12.1 through 0.14.3 and prioritize them for patching
Restrict write access to vifm configuration directories to the owning user only

Patch Information

The upstream fix is committed in 23063c741f15a85621fd232dfc3ac5b779f6910d in the vifm repository, which adds a length check and corrects the trie implementation. Distribution packages built from sources that include this commit resolve the issue. See the GitHub Vifm Commit Reference and the CERT Poland CVE Analysis for additional detail.

Workarounds

Clear or truncate existing vifm history files before launching the application on vulnerable versions
Avoid running vifm in environments where untrusted processes can write to its history or state files
Set restrictive file permissions on ~/.config/vifm/ to prevent tampering by other local accounts

bash

# Verify installed vifm version and tighten config directory permissions
vifm --version
chmod 700 ~/.config/vifm
chmod 600 ~/.config/vifm/vifminfo.json 2>/dev/null || true