{"action":"Upgrade vifm to 0.14.3-3 or later.","affected":[{"fixed":"0.14.3-3","introduced":"0"}],"component":"vifm","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["0.14.3-3"],"id":"tcs_01M5NWD26KGM3MP10TEV24J735","modified_at":"2026-10-01T03:03:53.630894907Z","published_at":"2026-05-22T14:16:30.197Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-8997","https://security-tracker.debian.org/tracker/CVE-2026-8997"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-8997#Debian:14/vifm","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-8997"}],"summary":"vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length o"}