CVE-2026-33633

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

This update for kitty fixes the following issues:

Changes in kitty:

• Update to 0.48.2:

  • Wayland: Fix regression in previous release that broke drag and drop on Plasma (#10284)
  • diff kitten: Fix a rare crash when showing a large diff due to incorrect locking when highlighting
  • Allow the private DCS kitty-echo escape code to only echo numbers
  • Linux: Fix an approx 1MB memory leak when reloading the config, introduced in version 0.40.0 (#10290)
  • Desktop file chooser integration: when the specified directory does not exist, open file chooser at home directory (#10292)
  • Add support for terminal visibility reports
    • https://rockorager.dev/misc/visibility-reports/
  • tab_title_template: Add a field that evaluates to the total memory used by all child processes in the tab (#10293)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.tab_title_template

• Update to 0.48.1:

  • Wayland: fix a regression in the previous release that broke window sizing for on Hyprland/Sway with fractional scales and an initial specified size (#10268)
  • Wayland: fix a regression in 0.47.3 that broke dragging on the Niri compositor (#10271)
  • Wayland: get initial window size in cells working in most cases on Hyprland/Sway with fractional scaling by using the fractional scale of the primary monitor
  • Wayland: fix using remote control to resize OS windows on some tiling compositors leading to broken rendering
  • macOS: fix edge=none panel height shrinking when margin_top is non-zero in the panel/quick-access-terminal kittens (#10278)

• Update to 0.48.0:

  • Implement vertical tabs by setting tab_bar_edge to left or right (#9855)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.tab_bar_edge
  • Graphics protocol: Add a new transient usage hint that clients can send to terminals to indicate an image is meant for only short duration use (#10092)
    • https://sw.kovidgoyal.net/kitty/graphics-protocol/#image-usage-hints
  • On first press in an unfocused OS Window/kitty window give it focus and pass the mouse event through to the clicked element. This is a behavior change but aligns with platform defaults on macOS. Linux has no platform defaults here as far as I can tell, so it gets to follow along. (#10233)
  • kitten @ get-text: Add support for alternate and alternate_scrollback extents to fetch text from the alternate screen buffer (#10165)
  • Wayland: Fix first OS window being a few cells too small when initial_window_width/initial_window_height are set in cells and a fractional display scale is in use (#10146)
  • macOS: New option macos_ns_window_layer to more precisely control what layer panel OS windows are placed on (#10116)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.macos_ns_window_layer
  • macOS: New option macos_use_physical_screen_frame to allow panel OS Windows to cover the macOS global dock bar (#10116)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.macos_use_physical_screen_frame
  • kitty binary builds are now built on Ubuntu 22 upgraded from Ubuntu 18 for improved performance from better compilers
  • macOS: Fix incorrect horizontal alignment when using text sizing protocol (#10179)
  • edit-in-kitty: Return exit code from underlying editor process on exit (#10198)
  • Make erasing last command robust against commands with no output and commands in the scrollback (#10201)
  • Fix superfluous margin visible to the left and right of the tab bar when background_opacity is less than one and the window width is not a multiple of the cell width (#10212)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.background_opacity
  • hints kitten: Add a new flag kitty +kitten hints --prefix-free to generate hints without a shared prefix (#10210)
    • https://sw.kovidgoyal.net/kitty/kittens/hints/#cmdoption-kitty-kitten-hints-prefix-free
  • Wayland GNOME: Fix…

It was discovered that kitty incorrectly handled certain image data. An attacker able to write to the terminal's input could possibly use this issue to cause kitty to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-33633)

It was discovered that kitty incorrectly handled certain graphics commands. An attacker able to write escape sequences to a kitty terminal could possibly use this issue to cause kitty to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-33642)