PT-2026-41985 · Kitty · Kitty

Published 2026-05-19 · Updated 2026-05-24 · CVE-2026-33633

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.47.0

Description A heap buffer overflow exists in the load image data() function. This occurs when a process writes to the terminal's stdin using a single APC graphics protocol command with a PNG format declaration (f=100) where the payload exceeds twice the initial buffer capacity. An attacker can control both the length and content of the overflow, which can lead to an immediate crash (Denial of Service) or potentially result in Remote Code Execution (RCE), where an attacker executes arbitrary code on the target machine.

Recommendations Update to version 0.47.0.

Exploit

Fix

DoS

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-33633

Affected Products

Kitty

References · 13

• 🔥 https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33633 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33633 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33633 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33633 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33633 · Vendor Advisory
• https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34 · Note
• https://t.me/CVEtracker/54271 · Telegram Post
• https://t.me/cveNotify/164117 · Telegram Post
• https://twitter.com/dailycve/status/2058339009571537244 · Twitter Post
• https://twitter.com/CVEnew/status/2056870201635770698 · Twitter Post
• https://t.me/cveNotify/164657 · Telegram Post