Description
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.
References (3)
Core 3
Core References
Third Party Advisory third-party-advisory
https://cert.pl/en/posts/2026/06/CVE-2026-53432
Product product
https://github.com/junegunn/fzf
Issue Tracking issue-tracking
https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91
Scores
CVSS v3
7.5
EPSS
0.0024
EPSS Percentile
15.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-190
Status
published
Products (2)
fzf/fzf
< 0.73.1
junegunn/fzf
< 0.73.1
Published
Jun 30, 2026
Tracked Since
Jun 30, 2026