CVE-2026-110237

Name	CVE-2026-110237
Description	Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150939

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vifm (PTS)	bookworm	0.12-1	vulnerable
	trixie	0.14-3	vulnerable
	forky, sid	0.14.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vifm	source	(unstable)	0.14.5-1			1150939

Notes

[trixie] - vifm <no-dsa> (Minor issue)
[bookworm] - vifm <postponed> (Minor issue; can be fixed in next update)
https://github.com/vifm/vifm/issues/1172
Fixed by: https://github.com/vifm/vifm/commit/ebac13bfc52faac7d714b4166851ff63a43d563f