Vifm EUVD-2026-99021

Requires a multi-user system where vifm uses a shared temporary directory, and a local attacker account able to create a world-writable vifm-ipc-vifm FIFO there before the victim runs vifm. The victim must then actually launch vifm (UI:P passive interaction), at which point the stale, attacker-owned FIFO is reused without an ownership check. Exploitation is limited to shared hosts with a common temp directory; single-user systems and sessions where the victim never starts vifm after the malicious FIFO is planted are not affected, and the attacker needs an existing local foothold (PR:L).

This is a genuine but conditional local privilege/trust-boundary flaw rather than a mass-exploitation priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P, score 7.0 High) is internally consistent with the description: exploitation requires local access (AV:L), an existing low-privileged account (PR:L), and passive victim interaction (UI:P) in that the victim must independently launch vifm. No EPSS score, KEV listing, or POC flag was supplied in the input; per the data available this is 'no public exploit identified at time of analysis', though a technical write-up (hackmd) and a VulnCheck advisory are referenced and describe the mechanism in detail, so working exploit knowledge is effectively public even if no packaged exploit is confirmed. There is no SSVC decision data provided. The signals do not conflict: a High-but-not-Critical score, local-only vector, and required victim interaction all point to a realistic threat on shared multi-user hosts rather than widespread remote compromise. CWE-283 (unverified ownership) matches the root cause. Note the input Tag 'Information Disclosure' contradicts the description and the VC:H/VI:H/VA:H impact - this is cross-user arbitrary command execution, not information disclosure.

On a shared multi-user Linux host, a local attacker pre-creates a world-writable FIFO named vifm-ipc-vifm in the shared temporary directory. When the victim later launches vifm, it reuses the attacker-owned FIFO without verifying ownership; the attacker writes an IPC packet containing -c and ! shell commands that then execute with the victim's privileges. Technical write-ups (hackmd, VulnCheck advisory) document the mechanism, but no packaged public exploit is confirmed in the input.