CVE-2026-95834— Kitty 拖拽协议释放后使用漏洞
一分钟漏洞结论
影响对象
Kovid Goyal kitty
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
以下是该漏洞描述信息的中文翻译： kitty 拖放协议中拖放源路径存在“释放后使用”（Use-After-Free）漏洞 在 kitty 终端模拟器版本 0.47.0 至 0.49.0（不含）之间，拖放协议（drag and drop protocol）的拖放源路径中存在一个“释放后使用”（Use-After-Free）漏洞。该漏洞允许正在向终端写入数据的恶意程序，导致终端读写已释放的堆内存。 漏洞成因： 中的 函数持有对不属于其自有数组的 指针的引用，并调用了 或 ，随后继续使用该指针。这些辅助函数（helper
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-95834 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer
来源: CVE Program / CVE List V5
Vulnerability Description
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O_CREAT with O_EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add_payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag_free_offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
释放后使用
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Kovid Goyal | kitty | 0.47.0 ~ 0.49.0 | - |
|
二、漏洞 CVE-2026-95834 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-95834 的情报信息
请登录查看更多情报信息。
CVE-2026-95834 其他参考 (3)
-
https://secur0.com/en/cna/cve-list/cve-2026-95834-kitty-dnd-use-after-free third-party-advisory technical-description
-
https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0 release-notes
同批安全公告 · Kovid Goyal · 2026-09-25 · 共 6 条
| CVE-2026-95832 | 9.3 CRITICAL | Kitty终端反射命令执行漏洞 |
| CVE-2026-80431 | 6.8 MEDIUM | Kitty 终端越界写入漏洞 |
| CVE-2026-80432 | 6.0 MEDIUM | Kitty拖放协议缺失授权漏洞 |
| CVE-2026-95835 | 5.6 MEDIUM | Kitty Askpass 共享内存对象所有权检查缺失漏洞 |
| CVE-2026-80430 | 4.6 MEDIUM | Kitty拖放协议链接解析不当导致任意文件创建漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-95834
暂无评论