← Vulnerability feed

Vulnerability record · CVE-2026-33642 · published 19 May 2026

CVE-2026-33642: Kovidgoyal kitty out-of-bounds read vulnerability

Kovidgoyal · Kitty

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

9.8 CVSS 3.1 Critical EPSS 0.43% · top 64.8% CWE-125 · Out-of-bounds readCWE-190 · Integer overflow
9.8CVSS 3.1 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
24 Jul 2026Last modified by NVD

Description

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34 Patch
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-qfgm-2c64-6x3x ExploitMitigationVendor Advisory
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-qfgm-2c64-6x3x ExploitMitigationVendor Advisory

Track CVE-2026-33642 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-35605Kovidgoyal kitty vulnerabilityThe Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing sp…EPSS 3.8%8.8CVE-2026-33633Kovidgoyal kitty heap-based buffer overflow vulnerabilityKitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process w…EPSS 0.46%7.8CVE-2026-42851Kovidgoyal kitty code injection vulnerabilityKitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a d…EPSS 0.19%7.8CVE-2025-43929Kovidgoyal kitty origin validation error vulnerabilityopen_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an un…EPSS 0.19%7.4CVE-2026-42850Kovidgoyal kitty command injection vulnerabilityKitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error.…EPSS 0.41%7.3CVE-2026-54057Kovidgoyal kitty code injection vulnerabilityKitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled by…EPSS 0.17%7.1CVE-2026-54056Kovidgoyal kitty link following vulnerabilityKitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwr…EPSS 0.38%5.0CVE-2026-54055Kovidgoyal kitty link following vulnerabilityKitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmis…EPSS 0.10%

Source: NIST National Vulnerability Database (record CVE-2026-33642), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.