Feh is a lightweight, command-line image viewer for Unix-like systems with a narrow but focused vulnerability profile concentrated in its image-handling and file-access routines. The observed weakness classes—improper link resolution, input validation gaps, and out-of-bounds writes—reflect the parser and memory-management demands of processing untrusted image formats and user-supplied file paths. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Feh Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-7875CRITICAL In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC me | Apr 14, 2017 | 9.8 | 32 | NO | NO |
CVE-2010-2246MEDIUM feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL. | May 26, 2011 | 5.1 | 30 | NO | YES |
The feh_unique_filename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh_ temporary file, a differ | Feb 14, 2011 | 3.3 | 15 | NO | NO |
The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file. | Feb 14, 2011 | 3.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Feh Project.
Media articles that mention a CVE ID that affects a product developed by Feh Project — matched by CVE ID, not by vendor name.