Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-33642— Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check

Quick assessment

Affected
kovidgoyal kitty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

KiTTY是一个轻量级的telnet和WindowsSSH客户端。 Kitty 0.46.2及之前版本存在缓冲区错误漏洞，该漏洞源于handle_compose_command()中无符号32位算术整数溢出，导致堆缓冲区过度读取或写入。

CVSS 9.9 · Critical EPSS 0.43% · P35

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
kovidgoyal kitty < 0.47.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-33642

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
Source: CVE Program / CVE List V5
Vulnerability Description
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
KiTTY 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
KiTTY是一个轻量级的telnet和WindowsSSH客户端。 Kitty 0.46.2及之前版本存在缓冲区错误漏洞，该漏洞源于handle_compose_command()中无符号32位算术整数溢出，导致堆缓冲区过度读取或写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
kovidgoyal kitty < 0.47.0 -

II. Public POCs for CVE-2026-33642

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-33642

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-33642 (1)

Vendor Advisories for CVE-2026-33642 (1)

IV. Related Vulnerabilities

Same product: kitty
Same vendor: kovidgoyal
Same weakness: CWE-190

V. Comments for CVE-2026-33642

No comments yet

Leave a comment