CVE-2026-53432: Junegunn Fzf DOS Vulnerability

CVE-2026-53432 Overview

CVE-2026-53432 is an integer overflow vulnerability [CWE-190] in fzf, a widely used command-line fuzzy finder written in Go. The flaw resides in the FuzzyMatchV2 function within src/algo/algo.go. When an input line of approximately 2,200,000 bytes is processed against a pattern of 999 bytes, the multiplication N*M overflows on 32-bit builds. The Go runtime detects the invalid slice bounds and terminates the process with a non-recoverable panic. The issue was fixed in fzf version 0.73.1.

Critical Impact
An attacker who can influence input passed to fzf can trigger an integer overflow that crashes the process, resulting in denial of service for interactive shells, scripts, or automation pipelines that rely on fzf.

Affected Products

junegunn/fzf versions prior to 0.73.1
32-bit builds of fzf invoking FuzzyMatchV2
Shell integrations, scripts, and tooling embedding vulnerable fzf binaries

Discovery Timeline

2026-06-30 - CVE-2026-53432 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-53432

Vulnerability Analysis

The vulnerability is an integer overflow in the guard condition of FuzzyMatchV2. The function evaluates N*M > cap(slab.I16) to decide whether to fall back to the greedy FuzzyMatchV1 algorithm. On 32-bit builds, the multiplication of N (input length) and M (pattern length) is performed using native int width. When N reaches roughly 2.2 million bytes and M reaches 999 bytes, the product exceeds the representable range and wraps to a smaller value. The guard fails to redirect execution to the safe fallback, and the code proceeds to allocate a slice using overflowed bounds. Go's runtime bounds check then triggers a panic that terminates the process.

Root Cause

The root cause is the use of platform-dependent integer width for a size computation that can exceed 32-bit limits. The original code did not promote operands to a wider type before multiplication, so overflow occurred silently before the comparison. The patch promotes N, M, and cap(slab.I16) to int64 prior to the multiplication, ensuring the comparison uses the true product regardless of build target.

Attack Vector

Exploitation requires local input delivery to fzf and user interaction, such as invoking a shell function or script that pipes attacker-controlled data into the tool. The impact is limited to availability. There is no confidentiality or integrity impact, and the process crash does not yield code execution.

// Source: https://github.com/junegunn/fzf/commit/ccedd064ca56921a4235219516b3d834f60e7b91
// Security patch in src/algo/algo.go - guards FuzzyMatchV2 against 32-bit overflow
 	// we fall back to the greedy algorithm.
 	// Also, we should not allow a very long pattern to avoid 16-bit integer
 	// overflow in the score matrix. 1000 is a safe limit.
-	if slab != nil && N*M > cap(slab.I16) || M > 1000 {
+	if slab != nil && int64(N)*int64(M) > int64(cap(slab.I16)) || M > 1000 {
 		return FuzzyMatchV1(caseSensitive, normalize, forward, input, pattern, withPos, slab)
 	}

The patch replaces the vulnerable comparison with widened int64 operands. This preserves the original safety intent of falling back to FuzzyMatchV1 on oversized inputs.

Detection Methods for CVE-2026-53432

Indicators of Compromise

Unexpected termination of fzf processes with Go runtime panic messages referencing slice bounds out of range
Shell sessions or automation pipelines invoking fzf failing when processing large input streams near 2.2 MB in size
Presence of fzf binaries reporting versions earlier than 0.73.1 via fzf --version

Detection Strategies

Inventory installed fzf binaries across endpoints and compare reported versions against the fixed release 0.73.1
Monitor process exit codes and standard error for Go panic traces originating from algo.go in fzf invocations
Review shell integrations and scripts that pass untrusted or unbounded input into fzf for fuzzy matching

Monitoring Recommendations

Enable process telemetry on developer workstations and build servers where fzf is commonly installed
Alert on repeated crash events involving the fzf binary within short time windows, which may indicate probing
Track package manager updates for fzf across Homebrew, apt, dnf, and Go module builds to confirm patched deployment

How to Mitigate CVE-2026-53432

Immediate Actions Required

Upgrade fzf to version 0.73.1 or later on all systems where it is installed
Rebuild any tooling that vendors fzf as a Go dependency against the patched release
Audit scripts and shell functions that feed untrusted input into fzf and constrain input size where feasible

Patch Information

The fix is delivered in fzf version 0.73.1 via commit ccedd064ca56921a4235219516b3d834f60e7b91. Refer to the GitHub fzf Commit Details and the CERT Post for CVE-2026-53432 for the authoritative advisory. The patch widens the multiplication in the FuzzyMatchV2 guard to int64, eliminating the overflow on 32-bit builds.

Workarounds

Prefer 64-bit fzf builds where the overflow condition is substantially harder to reach
Truncate or size-limit input passed to fzf in shell pipelines using head -c or similar controls
Restrict fzf invocations in automation to trusted input sources until the upgrade is applied

bash

# Verify installed fzf version and upgrade to the patched release
fzf --version

# Homebrew
brew update && brew upgrade fzf

# Go install of the fixed release
go install github.com/junegunn/fzf@v0.73.1

# Optional input size guard for shell pipelines
cat large_input.txt | head -c 1000000 | fzf