CVE-2026-33633: Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in loadimagedata() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/kittyto a version that resolves this vulnerability.Fixed in 0.41.1-2+deb13u1Fixed in 0.47.3-1Fixed in 0.47.4-1 - Upgrade
Upgrade
kittyto a version that resolves this vulnerability.Fixed in 0.47.0 - Compensating control
If upgrading is not immediately possible, restrict which processes/users can write to the terminal's stdin, since any process that can write to stdin can crash kitty (versions 0.46.2 and below) via the attacker-controlled heap buffer overflow in load_image_data().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33633?
CVE-2026-33633 has a high severity due to its potential to crash the Kitty terminal through a heap buffer overflow.
How do I fix CVE-2026-33633?
To fix CVE-2026-33633, upgrade Kitty to version 0.46.3 or later.
What versions of Kitty are affected by CVE-2026-33633?
Kitty versions 0.46.2 and below are affected by CVE-2026-33633.
What is the impact of CVE-2026-33633 on users?
The impact of CVE-2026-33633 allows any process writing to stdin to crash the Kitty terminal.
Can CVE-2026-33633 be exploited remotely?
While CVE-2026-33633 requires local access to stdin to exploit, it poses a significant risk if an adversary can manipulate input.