{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"vifm","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NWD22YMMSVPJWS5G4Q5C62","modified_at":"2026-10-01T03:03:53.630894907Z","published_at":"2026-05-22T14:16:30.197Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-8997","https://security-tracker.debian.org/tracker/CVE-2026-8997"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-8997#Debian:13/vifm","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-8997"}],"summary":"vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length o"}