CVE-2026-53432

Integer Overflow in fzf

CVSS 5.6 MEDIUMEPSS 0.1%CWE-190

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.6EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Produtos afetados

fzf · fzf

Referências

https://cert.pl/en/posts/2026/06/CVE-2026-53432 https://github.com/junegunn/fzf https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91