kitty EUVD-2026-87063

Requires kitty version 0.47.0 up to (not including) 0.49.0 with the drag-and-drop protocol in use. The attacker must be able to write to the terminal (control program output, escape sequences, or a file rendered to the screen), and the victim must actively initiate a drag-and-drop operation from the terminal (UI:A) - it is not triggered by output alone. The malicious drag source must declare two identically-named entries (a symlink followed by a directory), and the symlink target must be an existing directory writable by the user running kitty. Key limiting factors: local attack vector (no direct network exploitation of the process), mandatory user drag interaction, and O_CREAT|O_WRONLY|O_EXCL semantics that prevent overwriting any existing file - only brand-new files (mode 0644) and directories (mode 0755) can be created.

This is a genuine but low-to-moderate priority local integrity flaw, not a high-urgency remote threat. The vendor CVSS 4.0 base score is 4.6 (MEDIUM) with vector AV:L/AC:L/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - the attack vector is LOCAL and requires active user interaction (UI:A), and impact is limited to a low subsequent-system integrity effect (SI:L) with zero confidentiality or availability impact. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no signal of active or automated exploitation. The single most important conflicting signal is the 'RCE' tag, which is NOT supported by the data: every impact metric for the vulnerable system is N (VC:N/VI:N/VA:N), and the description explicitly states files are created with O_CREAT|O_WRONLY|O_EXCL so existing files CANNOT be overwritten, only new files/directories created - that materially caps escalation to code execution. Treat the 'RCE' label as unverified/inflated. The realistic risk is an attacker who controls output written to the terminal (e.g., malicious program output, an SSH session, or a crafted file cat'd to the screen) planting attacker-named files/directories in user-writable locations when the victim performs a drag-and-drop, which could seed configuration or autostart-style files but cannot clobber existing ones.

A user runs kitty (0.47.0-0.48.x) and views output from a malicious source - a compromised remote host over SSH, or a booby-trapped file printed to the terminal. That output drives the drag-and-drop protocol to declare two entries with the same name (a symlink to an arbitrary absolute directory, then a directory); when the victim initiates a drag from the terminal, kitty follows the symlink and writes attacker-controlled files/directories outside its staging area. No public exploit code is identified in the input, though the reporter (Secur0) published a technical write-up.