Kitty Terminal EUVD-2026-30968

The victim must be running Kitty version 0.46.2 or earlier with its default graphics protocol support enabled (no opt-in configuration is required), and the attacker must be able to cause at least one stream of bytes - an escape sequence beginning with ESC_G containing a compose action 'a=c' with crafted x_offset/y_offset values - to reach the terminal's stdout. Practical delivery channels named in the advisory are a malicious file rendered by cat/less, an SSH server's pre-auth login banner, or any piped command output. Limiting factors: the user must actually open or connect to attacker-influenced content in Kitty specifically (other terminals are unaffected), and the impact achievable depends on heap layout at the moment of the wrapped offset write, which is non-deterministic. No authentication to Kitty is involved and no user interaction beyond viewing output is needed.

Signals are largely consistent and point to genuine high priority. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N is supported by the description: any actor whose output reaches the user's terminal (SSH login banner, malicious file viewed with cat/less, hostile log line, web-served text) can trigger the bug with no authentication or interaction. Scope:Changed and A:H reflect that a corrupted terminal process can crash or be coerced into reading/writing arbitrary heap memory, with C:L/I:L acknowledging that leak/write primitive is constrained rather than full RCE-confirmed. EPSS and CISA KEV data were not provided in the input, so exploitation likelihood and active-exploitation status are unknown - treat the 9.9 base score with that caveat. No public exploit identified at time of analysis, but the upstream commit clearly exposes the root cause, which lowers the bar to weaponization. Overall this is a real priority for any environment where users SSH into untrusted hosts or process untrusted text in Kitty.

An attacker hosts a malicious file, log line, or SSH login banner containing a Kitty graphics protocol compose command with carefully chosen x_offset/y_offset values designed to wrap during the 32-bit bounds check. When the victim cats the file, tails the log, or SSHes to the server from a Kitty terminal, handle_compose_command() accepts the values and compose_rectangles() performs a massive out-of-bounds heap read/write, crashing the terminal or potentially corrupting adjacent heap structures. No public exploit identified at time of analysis, though the upstream patch makes the overflow condition explicit.