CVE-2026-53432CWE-190

Integer Overflow in fzf

Medium · published June 30, 2026

CVSS v4.0
5.6
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.

This issue was fixed in version 0.73.1.

The record
Technical detail
CVSS v4.0
5.6 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00419 · 35.2th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-06-30T12:01Z
EPSS history
Timeline
  • 30 JUN 12:01Z
    Integer Overflow in fzf
    cvelistv5