CVE-2026-53432mediumCWE-190

CVE-2026-53432: medium-severity vulnerability in fzf

Integer Overflow in fzf

Published

Follow this CVE+ Monitor fzf+ Monitor fzf

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.6epss 0.4%
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
fzf · fzf
Related CVEs — fzf

In the same product, most dangerous first.

CVE-2026-53433MEDIUMDenial of Service in fzfEPSS 0.4%