CVE-2026-33642
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and b ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 12 | kitty | no fix listed |
| debian 13 | kitty | 0.41.1-2+deb13u1 |
| debian 14 | kitty | 0.47.0-1 |
| echo | kitty | 0.41.1-2+deb13u1 |
| rapidfort alpine 3.20 | kitty | 0.47.0-r0 |
| rapidfort alpine 3.21 | kitty | 0.47.0-r0 |
| rapidfort alpine 3.22 | kitty | 0.47.0-r0 |
| rapidfort alpine 3.23 | kitty | 0.47.0-r0 |
| rapidfort debian 12 | kitty | 0:0.41.1-2+deb13u1, 0:0.47.0-1 |
| rapidfort debian 13 | kitty | 0:0.41.1-2+deb13u1, 0:0.47.0-1 |
| rapidfort fedora 43 | kitty, kitty-doc, kitty-kitten and 2 more | 0.43.1-4.fc43 |
| rapidfort Oracle Linux 10 | kitty, kitty-doc, kitty-kitten and 2 more | 0.47.1-3.el10_3 |
Show all 33 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 12 | kitty | no fix listed |
| debian 13 | kitty | 0.41.1-2+deb13u1 |
| debian 14 | kitty | 0.47.0-1 |
| echo | kitty | 0.41.1-2+deb13u1 |
| rapidfort alpine 3.20 | kitty | 0.47.0-r0 |
| rapidfort alpine 3.21 | kitty | 0.47.0-r0 |
| rapidfort alpine 3.22 | kitty | 0.47.0-r0 |
| rapidfort alpine 3.23 | kitty | 0.47.0-r0 |
| rapidfort debian 12 | kitty | 0:0.41.1-2+deb13u1, 0:0.47.0-1 |
| rapidfort debian 13 | kitty | 0:0.41.1-2+deb13u1, 0:0.47.0-1 |
| rapidfort fedora 43 | kitty | 0.43.1-4.fc43 |
| rapidfort fedora 43 | kitty-doc | 0.43.1-4.fc43 |
| rapidfort fedora 43 | kitty-kitten | 0.43.1-4.fc43 |
| rapidfort fedora 43 | kitty-shell-integration | 0.43.1-4.fc43 |
| rapidfort fedora 43 | kitty-terminfo | 0.43.1-4.fc43 |
| rapidfort Oracle Linux 10 | kitty | 0.47.1-3.el10_3 |
| rapidfort Oracle Linux 10 | kitty-doc | 0.47.1-3.el10_3 |
| rapidfort Oracle Linux 10 | kitty-kitten | 0.47.1-3.el10_3 |
| rapidfort Oracle Linux 10 | kitty-shell-integration | 0.47.1-3.el10_3 |
| rapidfort Oracle Linux 10 | kitty-terminfo | 0.47.1-3.el10_3 |
| rapidfort Oracle Linux 9 | kitty | no fix listed |
| rapidfort Oracle Linux 9 | kitty-doc | no fix listed |
| rapidfort Oracle Linux 9 | kitty-kitten | no fix listed |
| rapidfort Oracle Linux 9 | kitty-shell-integration | no fix listed |
| rapidfort Oracle Linux 9 | kitty-terminfo | no fix listed |
| rapidfort ubuntu 20.04 | kitty | 0:0.41.1-2+deb13u1build0.25.10.1, 0:0.47.0-3 |
| rapidfort ubuntu 22.04 | kitty | 0:0.41.1-2+deb13u1build0.25.10.1, 0:0.47.0-3 |
| rapidfort ubuntu 24.04 | kitty | 0:0.41.1-2+deb13u1build0.25.10.1, 0:0.47.0-3 |
| ubuntu 20.04-ESM | kitty | 0.15.0-1ubuntu0.2+esm1 |
| ubuntu 22.04 | kitty | no fix listed |
| ubuntu 24.04 | kitty | no fix listed |
| ubuntu 25.10 | kitty | 0.41.1-2+deb13u1build0.25.10.1 |
| ubuntu 26.04 | kitty | no fix listed |