CVE-2026-53432
Integer Overflow in fzf
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Integer Overflow in fzf
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
- Record
CVE-2026-53432- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-40302
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
- Record
EUVD-2026-40302- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rrf5-grxg-q8mm
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line...
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
- Record
GHSA-rrf5-grxg-q8mm- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
- Record
CVE-2026-53432- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Integer Overflow in fzf
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
- Record
CVE-2026-53432- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-53432
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.
- Record
DEBIAN-CVE-2026-53432- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-53432
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.
- Record
UBUNTU-CVE-2026-53432- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fzfDebian:12 |
All versions, plus listed versions 0.38.0-10.42.0-10.44.1-10.46.1-10.55.0-1 Show 17 moreShow less0.56.3-10.57.0-10.58.0-10.60.0-10.60.1-10.60.2-10.60.3-10.64.0-10.65.1-10.66.0-10.67.0-10.70.0-10.72.0-10.73.1-10.74.1-10.74.3-10.74.4-1 |
None known |
fzfDebian:13 |
All versions, plus listed versions 0.60.3-10.64.0-10.65.1-10.66.0-10.67.0-1 Show 6 moreShow less0.70.0-10.72.0-10.73.1-10.74.1-10.74.3-10.74.4-1 |
None known |
fzfDebian:14 |
before 0.73.1-1, plus listed versions 0.60.3-10.64.0-10.65.1-10.66.0-10.67.0-10.70.0-10.72.0-1 |
0.73.1-1 |
fzfUbuntu:20.04:LTS |
All versions, plus listed versions 0.18.0-20.18.0-30.19.0-10.20.0-10.20.0-1ubuntu0.1 |
None known |
fzfUbuntu:22.04:LTS |
All versions, plus listed versions 0.24.3-10.29.0-10.29.0-1ubuntu0.1 |
None known |
fzfUbuntu:24.04:LTS |
All versions, plus listed versions 0.42.0-1build10.44.1-10.44.1-1ubuntu0.10.44.1-1ubuntu0.20.44.1-1ubuntu0.3 |
None known |
fzfUbuntu:25.10 |
All versions, plus listed versions 0.60.3-1 |
None known |
fzfUbuntu:26.04:LTS |
All versions, plus listed versions 0.60.3-10.66.0-10.67.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53432 is a medium vulnerability (CVSS 5.6) in Fzf, published June 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in fzf 0.73.1-1.
References
cert.pl/en/posts/2026/06/CVE-2026-53432
github.com/junegunn/fzf
nvd.nist.gov/vuln/detail/CVE-2026-53432
security-tracker.debian.org/tracker/CVE-2026-53432
ubuntu.com/security/CVE-2026-53432
cve.org/CVERecord?id=CVE-2026-53432