CVE-2026-110237
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Risk Assessment
A local attacker can execute commands with another user's privileges, potentially leading to privilege escalation and account takeover.
Recommendation
Update Vifm to version 0.14.4 or later and secure the temporary directory against unauthorized writes.
Other vulnerabilities in Vifm
Original NVD description (English source)
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS