During the process of merging history entries when the state file is written, vifm performs no runtime check on the length of history strings in release builds. A crafted entry with an overly long path or command can overflow a heap buffer, corrupting adjacent memory or causing the application to crash. This vulnerability is a classic heap buffer overflow categorized as CWE‑122.

The vulnerable versions are the releases from 0.12.1 through 0.14.3 inclusive. Any install of vifm in that range is at risk if it writes the state file (vifminfo.json).

The CVSS score is 4.8, indicating a moderate severity that mainly results in memory corruption or denial of service rather than remote code execution. No EPSS data is available, and the flaw is not listed in CISA KEV. Exploitation would require an attacker to supply a malicious history entry that is later merged, implying a local or user‑prompted attack vector rather than a remote one. A successful attack could lead to application crashes or unpredictable behavior.