Read the docs
TI-2026-55508 Aliases CVE-2026-80431GHSA-fx7r-q727-j825

Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

Priority LOW 29CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Fixed kitty (Kovid Goyal): 0.49.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kovidgoyalkitty0.40.0 to before 0.49.00.49.0Patch availableCNA
  • kitty Vendorkovidgoyal Affected 0.40.0 to before 0.49.0 Fixed in 0.49.0 Patch available CNA

Remediation

  • Fix · CNA kitty (Kovid Goyal) Fixed in 0.49.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Kovid Goyal kitty 0.49.0

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-63703 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shellPriority MEDIUM 41
    • TI-2026-55509 Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a dropPriority LOW 26
    • TI-2026-63706 Missing ownership check on the shared memory object named by the kitty askpass escape codePriority LOW 24
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80431
  2. 2026-10-03 Alias added: GHSA-fx7r-q727-j825

References

Patch 1

Advisory 1

Other 1

  • TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
  • TI-2026-51129 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences CVSS 4.0HIGH 7.3
  • TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
  • TI-2026-51386 Missing authorization in kovidgoyal calibre CVSS 3.1HIGH 7.5
  • TI-2026-51385 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE CVSS 4.0HIGH 8.5
  • TI-2026-38585 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata CVSS 4.0HIGH 8.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences