CVE-2026-80431
published 2026-09-25CVE-2026-80431: Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to…
PriorityP427medium6.8CVSS 4.0
AVLACLATNPRNUIPVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.14%
2.7th percentile
Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kovid_goyal | kitty | >= 0.40.0 < 0.49.0 | 0.49.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-80431 kitty: out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process [fedora-all]
bugzilla·2026-09-28·CVSS 6.8
CVE-2026-80431 [MEDIUM] CVE-2026-80431 kitty: out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process [fedora-all]
CVE-2026-80431 kitty: out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type a
Bugzilla
CVE-2026-80431 kitty: out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process
bugzilla·2026-09-25·CVSS 6.8
CVE-2026-80431 [MEDIUM] CVE-2026-80431 kitty: out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process
CVE-2026-80431 kitty: out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process
Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Wh
2026-09-25
Published