Vulnerability · Published May 19, 2026 · Assigned by GitHub_M
CVE-2026-33642Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
Critical 9.9
In plain English
A critical-severity integer overflow in kitty from kovidgoyal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kitty | no fix listed | DEBIAN-CVE-2026-33642 |
| Debian:13 | kitty | 0.41.1-2+deb13u1 | DEBIAN-CVE-2026-33642 |
| Debian:14 | kitty | 0.47.0-1 | DEBIAN-CVE-2026-33642 |
| Ubuntu:25.10 | kitty | 0.41.1-2+deb13u1build0.25.10.1 | UBUNTU-CVE-2026-33642 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kovidgoyal | kitty | < 0.47.0 |
Weakness: CWE-190, CWE-787, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H