Skip to content

PatchFirst · Latest vulnerabilities

vifm vulnerabilities

Vulnerabilities published for vifm in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 3

CVE-2026-8997
Medium · CVSS 4.8EPSS 0.14%No fix published
Heap Buffer Overflow in vifm
vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7
vifm Operating systems
Published May 22, 2026Updated May 22, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-45985
High · CVSS 7.5EPSS 1.42%No fix published
CVE-2021-45985
In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
vifm Operating systems
Published April 10, 2023Updated February 12, 2025
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-43519
Medium · CVSS 5.5EPSS 1.23%No fix published
CVE-2021-43519
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.
vifm Operating systems
Published November 9, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →