CVE-2026-33633

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34	Patch
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g	Exploit Vendor Advisory
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-19 18:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-33633

Mitre link : CVE-2026-33633

CVE.ORG link : CVE-2026-33633

JSON object : View

Products Affected

kovidgoyal

kitty

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-33633", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33633", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"status": "affected", "version": "< 0.47.0"}]}]}], "published": "2026-05-19T18:16:21.343", "references": [{"url": "https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0."}, {"lang": "es", "value": "Kitty es un terminal multiplataforma basado en GPU. Las versiones 0.46.2 e inferiores contienen un desbordamiento de b\u00fafer de mont\u00f3n en load_image_data() que permite a cualquier proceso que pueda escribir en la entrada est\u00e1ndar (stdin) del terminal bloquear Kitty inmediatamente. La vulnerabilidad se activa mediante un \u00fanico comando del protocolo gr\u00e1fico APC con una declaraci\u00f3n de formato PNG (f=100) cuya carga \u00fatil excede el doble de la capacidad inicial del b\u00fafer. El desbordamiento es controlado por el atacante tanto en longitud como en contenido, causando DoS y potencialmente una escalada a RCE. Este problema ha sido solucionado en la versi\u00f3n 0.47.0."}], "lastModified": "2026-07-24T12:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5F5CC5E-DE6C-4B63-BE58-D083F148C37B", "versionEndExcluding": "0.47.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}