CVE-2026-53432

fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert.pl/en/posts/2026/06/CVE-2026-53432	Third Party Advisory
https://github.com/junegunn/fzf	Product
https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:junegunn:fzf:*:*:*:*:*:*:*:*

History

02 Jul 2026, 19:01

Type	Values Removed	Values Added
CPE		cpe:2.3:a:junegunn:fzf::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Junegunn Junegunn fzf
References	~~() https://cert.pl/en/posts/2026/06/CVE-2026-53432 -~~	() https://cert.pl/en/posts/2026/06/CVE-2026-53432 - Third Party Advisory
References	~~() https://github.com/junegunn/fzf -~~	() https://github.com/junegunn/fzf - Product
References	~~() https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91 -~~	() https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91 - Patch

30 Jun 2026, 13:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-30 13:19

Updated : 2026-07-02 19:01

NVD link : CVE-2026-53432

Mitre link : CVE-2026-53432

CVE.ORG link : CVE-2026-53432

JSON object : View

Products Affected

junegunn

fzf

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-53432", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53432", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T14:18:33.486018Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/junegunn/fzf", "vendor": "fzf", "product": "fzf", "versions": [{"status": "affected", "version": "0", "lessThan": "0.73.1", "versionType": "semver"}], "platforms": ["32 bit"], "programFiles": ["src/algo/algo.go"], "defaultStatus": "unaffected", "programRoutines": [{"name": "FuzzyMatchV2"}]}]}], "published": "2026-06-30T13:19:13.290", "references": [{"url": "https://cert.pl/en/posts/2026/06/CVE-2026-53432", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://github.com/junegunn/fzf", "tags": ["Product"], "source": "cvd@cert.pl"}, {"url": "https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91", "tags": ["Patch"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "fzf is vulnerable to\u00a0Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is\u00a0approximately 2,200,000 bytes and pattern length is 999 bytes, the product\u00a0overflows.\u00a0The Go runtime detects the invalid slice bounds and terminates the\u00a0process immediately with a non-recoverable panic.\n\nThis issue was fixed in version 0.73.1."}], "lastModified": "2026-07-02T19:01:11.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:junegunn:fzf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B9C3708-1223-421E-9641-DABD4A023A81", "versionEndExcluding": "0.73.1"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}