Read the docs
TI-2026-26014 Aliases CVE-2026-33633

Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler

Priority HIGH 73CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kitty (kovidgoyal): 0.47.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kovidgoyalkittybefore 0.47.00.47.0Patch availableCNA
  • kitty Vendorkovidgoyal Affected before 0.47.0 Fixed in 0.47.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*before 0.47.0Vulnerablekovidgoyal
  • cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:* Versions before 0.47.0 Vulnerable ·kovidgoyal

Remediation

  • Fix · CNA kitty (kovidgoyal) Fixed in 0.47.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33633

References

Exploit 1

Patch 1

  • TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
  • TI-2026-38991 Kitty vulnerable to command injection via unsanitized OSC 21 query reply CVSS 4.0HIGH 7.3
  • TI-2025-28495 Origin validation error in kitty CVSS 3.1HIGH 7.8
  • TI-2026-38990 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging CVSS 3.1HIGH 7.6
  • TI-2026-38989 Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol CVSS 3.1MEDIUM 5.0
  • TI-2020-18102 The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote… CVSS 3.1CRITICAL 9.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences