CVE-2026-33642
Kitty, a GPU‑based terminal, had a critical bug in versions 0.46.2 and earlier that allowed attackers to send crafted escape sequences to cause a heap buffer over‑read or over‑write. The flaw was fixed in version 0.47.0. Users should update to the patched release to eliminate the risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
kovidgoyal kitty, versions 0.46.2 and earlier.
Real-world impact
An attacker who can inject escape sequences into a Kitty terminal—such as through a malicious file, SSH banner, or piped content—can trigger out‑of‑bounds memory access, potentially corrupting memory or enabling arbitrary code execution without any user interaction.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is exploitable over the network, requires no privileges or user interaction, and changes the scope of the affected component. The impact is high availability (A:H) with low confidentiality and integrity impact, leading to a critical overall rating.
What to do about it
- 01Upgrade kitty to version 0.47.0 or later.
NVD-referenced vendor advisory
Timeline
- May 19, 2026 · May 19, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/kovidgoyal/kitty/commit/e96…patch
- github.com/kovidgoyal/kitty/security/a…exploitmitigationvendor advisory