TI-2026-26023 Aliases CVE-2026-33642

Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check

HIGH 82CWE-125Published 2026-05-19 · Updated 2026-05-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00286 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed kitty (kovidgoyal): 0.47.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kovidgoyal	kitty	before 0.47.0	0.47.0	Patch available	CNA

kitty Vendorkovidgoyal Affected before 0.47.0 Fixed in 0.47.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kovidgoyal:kitty::::::::	before 0.47.0	Vulnerable	kovidgoyal

cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:* Versions before 0.47.0 Vulnerable ·kovidgoyal

Remediation

Fix · CNA kitty (kovidgoyal) Fixed in 0.47.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-33642

References

Exploit 1

https://github.com/kovidgoyal/kitty/security/advisories/GHSA-qfgm-2c64-6x3x

Patch 1

https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34

TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
TI-2026-38991 Kitty vulnerable to command injection via unsanitized OSC 21 query reply CVSS 4.0HIGH 7.3
TI-2025-28495 Origin validation error in kitty CVSS 3.1HIGH 7.8
TI-2026-38990 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging CVSS 3.1HIGH 7.6
TI-2026-38989 Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol CVSS 3.1MEDIUM 5.0
TI-2020-18102 The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote… CVSS 3.1CRITICAL 9.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences