CVE-2026-33642
published 2026-05-19CVE-2026-33642: Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.29%
20.9th percentile
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kovidgoyal | kitty | < 0.47.0 | 0.47.0 |
| ubuntu | kitty | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
kitty vulnerabilities
vendor_ubuntu·2026-06-17·CVSS 8.8
CVE-2026-33642 [HIGH] kitty vulnerabilities
Title: kitty vulnerabilities
Summary: Several security issues were fixed in kitty.
It was discovered that kitty incorrectly handled certain image data. An
attacker able to write to the terminal's input could possibly use this
issue to cause kitty to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-33633)
It was discovered that kitty incorrectly handled certain graphics commands.
An attacker able to write escape sequences to a kitty terminal could
possibly use this issue to cause kitty to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33642)
Instructions: After a standard system update you need to restart kitty to make all the
necessary changes.
VulDB
kovidgoyal kitty up to 0.46.x File kitty/graphics.c handle_compose_command integer overflow (GHSA-qfgm-2c64-6x3x)
vuldb·2026-05-19·CVSS 9.9
CVE-2026-33642 [CRITICAL] kovidgoyal kitty up to 0.46.x File kitty/graphics.c handle_compose_command integer overflow (GHSA-qfgm-2c64-6x3x)
A vulnerability has been found in kovidgoyal kitty up to 0.46.x and classified as critical. Affected by this issue is the function handle_compose_command of the file kitty/graphics.c of the component File Handler. This manipulation causes integer overflow.
This vulnerability is tracked as CVE-2026-33642. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling
bugzilla·2026-05-19·CVSS 9.9
CVE-2026-33642 [CRITICAL] CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling
CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs t
Bugzilla
CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling [epel-all]
bugzilla·2026-05-19·CVSS 9.9
CVE-2026-33642 [CRITICAL] CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling [epel-all]
CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling [fedora-all]
bugzilla·2026-05-19·CVSS 9.9
CVE-2026-33642 [CRITICAL] CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling [fedora-all]
CVE-2026-33642 kitty: Kitty: Arbitrary Code Execution via Integer Wrapping in Escape Sequence Handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
2026-05-19
Published