CVE-2026-110237
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
CVE-2026-110237- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-283
- Updated
- 2026-11-02
EUVDEUVD-2026-99021
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
EUVD-2026-99021- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vf53-5m97-qg59
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory...
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
GHSA-vf53-5m97-qg59- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-283
- Updated
- 2026-11-02
NVD
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
CVE-2026-110237- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-283
- Updated
- 2026-11-02
OSV
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
CVE-2026-110237- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-283
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-110237
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
DEBIAN-CVE-2026-110237- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-110237
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
- Record
UBUNTU-CVE-2026-110237- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12311-1 No score
vifm-0.14.5-1.1 on GA media
These are all security issues fixed in the vifm-0.14.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12311-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vifmDebian:12 |
All versions, plus listed versions 0.12-10.13-10.14-10.14-20.14-3 Show 5 moreShow less0.14.3-10.14.3-20.14.3-30.14.4-10.14.5-1 |
None known |
vifmDebian:13 |
All versions, plus listed versions 0.14-30.14.3-10.14.3-20.14.3-30.14.4-10.14.5-1 |
None known |
vifmDebian:14 |
before 0.14.5-1, plus listed versions 0.14-30.14.3-10.14.3-20.14.3-30.14.4-1 |
0.14.5-1 |
vifmUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.8-30.7.8-3build1 |
None known |
vifmUbuntu:18.04:LTS |
All versions, plus listed versions 0.9-10.9.1-1 |
None known |
vifmUbuntu:20.04:LTS |
All versions, plus listed versions 0.10.1-20.10.1-3 |
None known |
vifmUbuntu:22.04:LTS |
All versions, plus listed versions 0.10.1-40.12-1 |
None known |
vifmUbuntu:24.04:LTS |
All versions, plus listed versions 0.12-10.12-1build10.12-1build2 |
None known |
vifmUbuntu:26.10 |
All versions, plus listed versions 0.14.3-10.14.3-30.14.4-1 |
None known |
vifmUbuntu:26.04:LTS |
All versions, plus listed versions 0.14-30.14.3-1 |
None known |
vifmopenSUSE:Tumbleweed |
before 0.14.5-1.1 | 0.14.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-110237 is a high vulnerability (CVSS 7.0) in Vifm, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in vifm 0.14.5-1.
References
hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg
github.com/vifm/vifm/blob/v0.14.4/src/ipc.c
vulncheck.com/advisories/vifm-0.8.1-beta-through-0.14.4-unverified-ipc-fifo-ownership-allows-cross-user-command-execution
nvd.nist.gov/vuln/detail/CVE-2026-110237