CVE-2026-53432: Integer Overflow in fzf
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fzfto a version that resolves this vulnerability.Fixed in 0.73.1 - Compensating control
If upgrading to fzf 0.73.1 is not immediately possible, reduce the maximum input line length and/or pattern length so the Integer Overflow condition (approx. 2,200,000 bytes input line length and 999 bytes pattern length) cannot be reached, preventing the crash in the FuzzyMatchV2 function.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53432?
The severity of CVE-2026-53432 is rated as 19.
What is the main issue described in CVE-2026-53432?
CVE-2026-53432 describes an integer overflow vulnerability in fzf that can cause a crash in the FuzzyMatchV2 function.
How do I fix CVE-2026-53432?
To fix CVE-2026-53432, update to the latest version of fzf that includes a patch for this vulnerability.
What conditions trigger the vulnerability in CVE-2026-53432?
The vulnerability in CVE-2026-53432 is triggered when the input line length is approximately 2,200,000 bytes and the pattern length is 999 bytes.
What impact does CVE-2026-53432 have on the fzf software?
CVE-2026-53432 can lead to a crash of the fzf application due to invalid slice bounds detected by the Go runtime.