EUVD-2026-40302
GHSA-rrf5-grxg-q8mm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity (specific ~2.2 MB line + ~999-byte pattern threshold required); user interaction needed; impact limited to availability only.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.
This issue was fixed in version 0.73.1.
AnalysisAI
Integer overflow in fzf's FuzzyMatchV2 function causes a non-recoverable process crash (denial of service) when input lines reach approximately 2,200,000 bytes and a search pattern of ~999 bytes is active. The Go runtime detects the resulting invalid slice bounds and immediately terminates the process with a panic - there is no recovery path and no possibility of memory corruption or code execution. No public exploit code has been identified and this CVE is not listed in CISA KEV; the CVSS 4.0 score of 5.6 (AT:P, UI:A) reflects that exploitation requires atypical input volumes and active user or script interaction.
Technical ContextAI
fzf (cpe:2.3:a:fzf:fzf:*:*:*:*:*:*:*:*) is a general-purpose command-line fuzzy finder written in Go, authored by Junegunn Choi and widely embedded in shell workflows and developer tooling. FuzzyMatchV2 is the primary scoring algorithm invoked on every search keystroke or piped input. CWE-190 (Integer Overflow or Wraparound) describes the root cause: an arithmetic operation on the input line length produces a value that exceeds the representable range of the integer type, yielding an invalid slice bound. Unlike C, the Go runtime enforces slice bounds at execution time and responds to a violation with an immediate, non-recoverable panic rather than allowing heap or stack corruption. This safety property constrains the impact strictly to availability - a crash - but eliminates any code-execution upgrade path from this specific bug class.
RemediationAI
Upgrade fzf to version 0.73.1 or later, which contains the fix introduced in commit ccedd064ca56921a4235219516b3d834f60e7b91 at https://github.com/junegunn/fzf. Users managing fzf via package managers (Homebrew, apt, pacman, etc.) should update to the corresponding packaged release of 0.73.1 or newer. The CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-53432 should be consulted for supplementary guidance. If immediate upgrade is not possible, the effective workaround is to pre-filter input before piping to fzf - for example, using awk 'length < 1000000' or cut -c1-1000000 to truncate lines exceeding a safe threshold before they reach fzf. This prevents the overflow trigger at the cost of silently truncating very long lines in the display, which may affect search accuracy over high-volume inputs but carries no security risk.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today