CVE-2012-4463: Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED env...

Security readout for executives and security teams

Midnight Commander 4.8.5 could run unintended commands when a user selected multiple files with a specially crafted filename. This is not reported as actively exploited in the supplied sources, but it can turn normal file browsing into command execution if a user handles untrusted files. Exposure is most likely on systems running Midnight Commander 4.8.5 where users browse directories containing untrusted or attacker-supplied filenames. Internet exposure is indirect and depends on user interaction with files delivered through another channel. Prioritize remediation where administrators or operators use mc on shared, production, or file-ingest systems. Broad emergency response is not supported by the supplied evidence, but arbitrary command execution justifies routine patching and exposure reduction. Mitigation focus: Inventory systems for Midnight Commander 4.8.5 installations.; Check Midnight Commander and distribution advisories for fixed packages.; Upgrade mc through trusted vendor or distribution channels when available..

Prepared

Jun 27, 2026, 16:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.