Vifm versions 0.8.1‑beta through 0.14.4 reuse a pre‑existing IPC FIFO located in the shared temporary directory without verifying its ownership, allowing a local user to create a world‑writable fifo named vifm‑ipc‑vifm and send IPC packets that contain shell commands such as −c and ! that are executed with the privileges of the Vifm process; this enables the attacker to run arbitrary code in the context of the user running Vifm, effectively bypassing user isolation.

The flaw impacts the Vifm file manager distributed under the vifm project; all releases from 0.8.1‑beta up to and including 0.14.4 run on any platform that supports a shared /tmp directory and are therefore vulnerable.

With a CVSS score of 7, the vulnerability is of high severity; exploitation requires only local access and does not rely on an elevated privilege or network exposure, making it a significant risk even though no EPSS score is available and it is not listed in the CISA KEV catalog; as a result, any local user can coerce the IPC server into executing commands with the target user’s privileges, potentially compromising sensitive data or system integrity.