PT-2026-41992 · Kitty · Kitty
Published
2026-05-19
·
Updated
2026-05-26
·
CVE-2026-33642
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Kitty versions prior to 0.47.0
Description
An issue exists in the
handle compose command() function within kitty/graphics.c where bounds validation on composition offsets uses unsigned 32-bit arithmetic. This process is subject to integer wrapping, which can lead to a Heap Buffer Over-Read/Write. An attacker capable of writing escape sequences to a terminal—such as through a malicious file, SSH login banner, or piped content—can provide crafted x offset and y offset values. These values may pass the bounds check after wrapping, resulting in significant out-of-bounds heap memory access in the compose rectangles() function. This can occur without user interaction or non-default configurations, requiring only the ability to produce output in the terminal window.Recommendations
Update to version 0.47.0.
Exploit
Fix
Out of bounds Read
Integer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Kitty