CVE-2026-33642: Kitty Terminal Heap Corruption
Critical CVSS (9.9) reachable over local.
TL;DR - CVE-2026-33642 is a critical heap out-of-bounds read/write vulnerability in Kitty’s graphics composition code. - Kitty versions 0.46.2 and earlier are affected. Upgrade to Kitty 0.47.0 or later. - Public triggering material exists, but confirmed in-the-wild exploitation and weaponized code execution have not been established. - Reduce exposure to untrusted terminal output until every installation is patched.
What Is the Root Cause?
The vulnerable path begins in handle_compose_command() in kitty/graphics.c and continues into compose_rectangles(). Kitty validates graphics composition offsets using unsigned 32-bit arithmetic. Attacker-controlled values can cause the arithmetic to wrap, producing a result that appears to fall within the buffer even though the actual offset points far beyond the allocated graphics memory.
This is an integer-wrapping-to-bounds-check failure. The security boundary is not the terminal escape sequence itself; it is the assumption that arithmetic used during validation accurately represents the later memory access. When that assumption fails, the composition routine may perform a heap buffer over-read or overwrite.
Potential consequences include:
- Heap buffer over-read, potentially disclosing process memory or causing a crash.
- Heap buffer overwrite using attacker-influenced pixel or composition data.
- Heap corruption that could support more serious exploitation.
- Denial of service through invalid memory access.
- A potential path toward arbitrary code execution, although confirmed code execution was not established.
No non-default Kitty configuration is required. The attacker’s practical requirement is the ability to produce output in a vulnerable Kitty window.
Technical Notes
The vulnerable operation is conceptually similar to this unsafe pattern:
/* Illustrative pattern, not a verbatim patch or source excerpt */
uint32_t end_x = x_offset + width;
if (end_x <= buffer_width) {
compose_rectangles(buffer, x_offset, y_offset, width, height);
}
If x_offset + width wraps in 32-bit arithmetic, end_x may become small enough to pass the check while x_offset remains outside the valid buffer.
Ordinary shell metacharacter filtering or command-injection defenses will not address this issue. The relevant payload is terminal control data, not necessarily a conventional command-injection string.
What Happened?
CVE-2026-33642 affects Kitty, a cross-platform, GPU-based terminal emulator. The flaw occurs when Kitty processes graphics composition commands containing carefully selected coordinate values. Unsigned 32-bit arithmetic can wrap during bounds validation, allowing an apparently valid check to precede a memory access outside the intended heap buffer.
An attacker does not need local code execution on the victim system. They need to cause crafted terminal output to be rendered by a vulnerable Kitty instance. Potential delivery paths include:
- Malicious files opened or displayed in Kitty.
- Attacker-controlled shell output.
- SSH login banners and remote command output.
- Content piped from an untrusted source.
- Terminal graphics escape sequences embedded in otherwise ordinary-looking text.
The vulnerability is particularly relevant to administrators, developers, and security teams who use Kitty for SSH sessions or routinely process content from external systems.
| Field | Assessment |
|---|---|
| CVE | CVE-2026-33642 |
| Product | Kitty terminal emulator |
| CVSS base score | 9.9 Critical |
| CVSS vector | Not exposed in the supplied NVD response; confirm directly in the NVD record before automated scoring |
| Attack vector | Attacker-controlled content rendered through a terminal; the exact CVSS vector requires confirmation |
| Authentication required | No application authentication is required, but the attacker must cause output to reach Kitty |
| User interaction | Not required according to the vulnerability description |
| Privileges required | No special attacker privileges are required |
| Affected versions | Kitty 0.46.2 and earlier |
| Fixed version | Kitty 0.47.0 or later is the safest documented target |
| Patch available | Yes |
| CISA KEV status | Not listed at the time of assessment |
The immediate impact may be a Kitty crash, including signals such as SIGSEGV or SIGBUS. Because the flaw allows attacker-influenced heap access, it is more serious than a simple denial-of-service issue. However, confirmed arbitrary code execution was not established in the reviewed sources.
Analyst’s Take: Patch Kitty installations first on systems used for SSH and administrative work. The practical exposure comes from rendering attacker-controlled output. Available evidence does not establish active exploitation or confirmed code execution, but defenders should not wait for those conditions before upgrading.
For broader guidance on evaluating software flaws and active exploitation evidence, see our critical cyber risks digest.
Who Needs to Act?
Organizations and individuals running Kitty 0.46.2 or earlier should treat those installations as vulnerable. The affected package is identified as kitty, and the vulnerable component is compiled into the terminal emulator itself.
The fixed-version information is inconsistent across the available records. The NVD description identifies 0.47.0 as the fixed version, while the GitHub advisory search result references 0.46.3 as a patched version. The safest general recommendation is to upgrade to Kitty 0.47.0 or later, unless a distribution vendor explicitly documents a backport containing the fix.
| Installation state | Required action |
|---|---|
| Kitty 0.46.2 or earlier from the upstream project | Upgrade to 0.47.0 or later |
| Distribution package reporting 0.46.3 | Verify the package changelog or security advisory before treating it as fixed |
| Distribution package with a downstream version string | Confirm the maintainer’s backported patch, not only the upstream version number |
| Unknown or unmanaged version | Inventory and upgrade rather than assuming the package is safe |
| Temporary unpatched system | Avoid untrusted terminal output and remote sessions where practical |
Prioritize:
- Administrative workstations.
- Developer endpoints used for SSH.
- Security operations systems.
- Jump hosts and remote-access systems.
- Machines that display files or output from external sources.
- Shared systems where multiple users can launch Kitty.
Managed environments should include Kitty in endpoint software inventories and verify the actual binary version rather than relying only on package metadata.
Why Is the CVSS Score Critical?
The supplied NVD information reports a CVSS base score of 9.9, classified as Critical. However, the complete CVSS vector was not exposed in the response reviewed for this assessment. Retrieve the vector directly from the NVD record before using individual metric values in compliance reports, automated prioritization, or risk dashboards.
The high score is consistent with the described technical characteristics:
- Exploitation can begin with attacker-controlled content rendered by a terminal.
- Special privileges are not required.
- No non-default configuration is required.
- Memory corruption is possible rather than only a controlled application error.
- The supplied description states that user interaction is not required.
Defenders should distinguish CVSS severity from confirmed exploitation. A Critical score indicates severe potential impact under the scoring model; it does not establish that attackers are currently exploiting the flaw or that every vulnerable installation is equally reachable.
The absence of the vector string is an important reporting caveat. Do not reconstruct or guess the vector. Confirm the authoritative NVD record before deriving attack-vector, privileges-required, or impact-component values programmatically.
Has CVE-2026-33642 Been Exploited?
CVE-2026-33642 was not listed in the CISA Known Exploited Vulnerabilities catalog at the time of assessment. There is therefore no CISA-confirmed active exploitation, KEV due date, or CISA ransomware-campaign association to report.
This does not prove that exploitation is absent. It means the available evidence does not include a CISA KEV listing.
Public PoC-related material is available through the Kitty GitHub security advisory. The material describes crafted composition commands capable of producing reliable denial of service and attacker-influenced out-of-bounds heap access. It also discusses heap corruption as a possible prerequisite for arbitrary code execution.
A public, independently validated weaponized exploit resulting in code execution was not established from the reviewed sources.
| Question | Assessment |
|---|---|
| Is public trigger or PoC-related material available? | Yes, through the GitHub security advisory |
| Is reliable denial of service described? | Yes |
| Is arbitrary code execution confirmed? | No |
| Is active exploitation confirmed in the wild? | No |
| Is the CVE in CISA KEV? | No, based on the supplied assessment |
| Should defenders wait for a KEV listing before patching? | No |
Because terminal escape-sequence vulnerabilities can be embedded in ordinary-looking output, the absence of public weaponized code should not be treated as a long-term safety indicator.
Bottom Line
Inventory every Kitty installation and upgrade versions at or below 0.46.2 to 0.47.0 or later. Validate downstream backports individually, then reduce exposure to untrusted terminal output while any systems remain unpatched.
The vulnerability is serious because crafted graphics escape sequences can trigger heap out-of-bounds access through integer wrapping. Public triggering material exists, but confirmed in-the-wild exploitation and arbitrary code execution have not been established. Patch based on the technical risk rather than waiting for a CISA KEV listing or weaponized exploit.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Begin by identifying every Kitty installation and recording its actual version. User-installed applications may be missed by centralized software inventory tools, so check:
- User home directories.
- Desktop application inventories.
- Package databases.
- Process execution telemetry.
- Portable application folders.
- Remote-access and jump-host inventories.
A vulnerable version alone does not prove compromise. Detection should combine version exposure with evidence that attacker-controlled terminal graphics were delivered or that Kitty crashed while processing suspicious content.
Relevant sources include:
- Shell history.
- SSH connection records.
- Terminal-session logs.
- Crash reports and core dumps.
- Endpoint detection telemetry.
- Network records for sessions preceding a Kitty crash.
- Files opened immediately before a crash.
Local Version Checks
A basic check identifies the running Kitty version:
kitty --version
On Linux systems using common package managers, supplement that check with:
command -v kitty
readlink -f "$(command -v kitty)"
dpkg-query -W -f='${Package} ${Version}\n' kitty 2>/dev/null || true
rpm -q kitty 2>/dev/null || true
The output format varies by platform. Record both the executable path and reported version because a patched distribution package may use a downstream version label.
Terminal-Log Triage
Kitty graphics protocols use terminal escape sequences, so raw logs may contain control bytes rather than readable text. A basic triage pattern can search preserved session output for the Kitty graphics introducer:
# Search a binary-safe session log for Kitty graphics protocol markers.
grep -a -n -E $'\033_G|\\x1b_G' /var/log/terminal-sessions/* 2>/dev/null
This is only a triage indicator:
- The presence of a Kitty graphics sequence does not prove malicious activity.
- Absence from sanitized logs does not prove that no sequence was rendered.
- Legitimate applications may also use Kitty graphics features.
Correlate suspicious sequences with Kitty crashes, unusual SSH sessions, and remote content retrieval.
Endpoint Detection
Endpoint detections should look for Kitty termination and crash artifacts around suspicious shell or SSH activity. Adapt the following example to the organization’s telemetry schema:
process.name = "kitty"
AND (event.action IN ("crash", "segmentation_fault", "core_dump")
OR signal IN ("SIGSEGV", "SIGBUS"))
Correlate those events with:
- An SSH connection from an untrusted or newly observed host.
- A command that reads or pipes remote content.
- A file opened immediately before the crash.
- A terminal-session log containing
ESC _ G. - The byte sequence
1b 5f 47. - Repeated Kitty crashes associated with the same remote source.
A crash is not proof of exploitation. Malformed but non-malicious terminal data, graphics-driver problems, and unrelated application defects can produce similar symptoms.
Remediation and Patching
Upgrade Kitty to 0.47.0 or later as the primary remediation. If Kitty is installed through an operating-system repository, confirm that the package includes the fix.
Because the upstream and advisory records contain an apparent discrepancy involving 0.46.3, organizations should prefer the newer 0.47.0-or-later target unless a trusted downstream maintainer documents an equivalent backport.
For Debian- or Ubuntu-style systems:
sudo apt update
sudo apt install --only-upgrade kitty
kitty --version
For Fedora- or RHEL-family systems where Kitty is supplied by an enabled repository:
sudo dnf upgrade kitty
kitty --version
If Kitty was installed from a downloaded release, replace the application using the project’s trusted release channel and verify the resulting binary:
kitty --version
command -v kitty
Do not assume that a version string alone proves remediation when a distribution backport is involved. Obtain the package changelog, vendor advisory, or build metadata confirming that the fix for CVE-2026-33642 is included.
Temporary Exposure Reduction
No reliable configuration-only workaround was identified that removes the vulnerable code path while preserving normal Kitty operation. Temporary controls should therefore be treated as exposure reduction, not a substitute for upgrading.
Until all instances are patched:
- Avoid opening untrusted files directly in Kitty.
- Be cautious when connecting to unknown SSH servers.
- Avoid piping remote or untrusted content into administrative sessions.
- Use a patched or alternative terminal for high-risk remote access.
- Route sensitive SSH activity through managed jump hosts.
- Avoid automatically displaying remote banners or graphics where possible.
- Isolate unpatched systems from high-risk content sources.
For example:
# The security control is to run this session in a patched or alternative
# terminal environment, not to make an unpatched Kitty instance safe.
ssh [email protected]
Verify Remediation Across User Contexts
After upgrading, verify remediation across all user contexts:
ps -eo user,pid,comm,args | grep -i '[k]itty'
find /home /Users -type f -name kitty -perm -111 2>/dev/null
The find command may be expensive or produce permission errors on large systems. Use endpoint-management inventory where available.
Retire or update stale copies located in:
- User directories.
- Portable application folders.
- Containers.
- Remote-access workstations.
- Alternate package-manager paths.
- Old backup or deployment directories.
For additional guidance on securing sensitive terminal data and recorded sessions, see practical controls for meeting recordings and transcripts.
References
-
NIST National Vulnerability Database, CVE-2026-33642:
https://nvd.nist.gov/vuln/detail/CVE-2026-33642 -
Kitty GitHub security advisory, GHSA-qfgm-2c64-6x3x:
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-qfgm-2c64-6x3x -
Kitty fix commit:
https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34 -
CISA Known Exploited Vulnerabilities Catalog:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog