VDB
CVE-2026-110237
CVE-2026-110237
PUBLISHED
CVSS 7 HIGH
Reported by VulnCheck · Published October 13, 2026
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Risk Scores
CVSS 4.0
7
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vifm | vifm | 0.8.1-beta |
| alpine | vifm | 0 |
| vifm | vifm | 0.8.1-beta |
Timeline
- Oct 13, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 14, 2026 Coalition ESS Score
- Oct 17, 2026 CVE Updated
- Oct 25, 2026 EPSS Score
References
- third-party-advisory
- technical-description
- technical-description
- v0.14.4 Release Notes release-notes
- VulnCheck Advisory: Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution third-party-advisory