EUVD-2026-87088
GHSA-fx7r-q727-j825
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to display hostile content in kitty
-
ExploitDeliver OSC 66 escape with >4-codepoint grapheme cluster
-
ExecutionUnbounded lc.chars[lc.count++] writes past 4-element buffer
-
Impactkitty process aborts, all tabs/child processes die
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the kitty terminal (versions 0.40.0 up to but not including 0.49.0) to render attacker-influenced output containing an OSC 66 text-sizing escape sequence in its NATURAL WIDTH branch (no explicit 'w' key) whose payload carries a single grapheme cluster longer than four codepoints. No authentication or elevated privileges are needed (PR:N), but exploitation is local (AV:L) - the attacker must get bytes written to the victim's terminal - and involves passive user interaction (UI:P), i.e. the victim viewing/running the terminal on the malicious content. Limiting factors: only affects kitty in the listed version range; the outcome is confined to crashing the terminal and its child processes (VA:H, no confidentiality/integrity impact). A preceding sequence that triggers an intermediate flush moves the overflow from stack to heap but does not change the crash outcome. |
| Impact | All impact signals converge on a denial-of-service-only flaw, not code execution. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, base 6.8 MEDIUM) sets confidentiality and integrity to none and only availability to high, which matches the description: the out-of-bounds write reliably terminates the kitty process along with all its windows, tabs, and child processes. Despite the CWE-787 (out-of-bounds write) classification and 'Memory Corruption' tag, the description does not claim controllable memory corruption or RCE - the payload writes sequential 32-bit codepoint values one-per-extra-codepoint, and the documented outcome is a crash. AV:L is correct because a program must already be writing to the terminal (local delivery via displayed content), and UI:P reflects that the victim must be viewing/running the affected terminal. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis.' Net: a legitimate, patch-worthy crash bug but a low real-world priority - not a high-CVSS-but-hyped RCE. Note the 'Buffer Overflow'/'Memory Corruption' tags could imply exploitability beyond DoS; the description and the CVSS VA:H-only impact do not support that. |
| Exploit ScenarioDerived | A victim runs kitty and displays attacker-controlled content - e.g. cat-ing a malicious file, viewing hostile log output, or connecting to a server that emits terminal escape codes. The content includes an OSC 66 natural-width text-sizing escape sequence carrying a grapheme cluster of more than four codepoints, overflowing the four-element stack (or heap-migrated) char buffer in screen_handle_multicell_command(). kitty crashes, killing all its windows, tabs, and child processes. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
A stack (or heap) out-of-bounds write in kitty terminal versions 0.40.0 up to but not including 0.49.0 allows any program that can emit escape sequences to the terminal to corrupt a fixed-size four-codepoint buffer while rendering an OSC 66 text-sizing sequence, crashing the kitty process and taking down every window, tab, and child process with it. The flaw is in screen_handle_multicell_command(), which appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without a capacity check in the natural-width branch of the text sizing protocol; a payload carrying a grapheme cluster longer than four codepoints writes one 32-bit value past the buffer for each additional codepoint. Exploitation is local and requires the user to view attacker-influenced terminal output (PR:N, UI:R); the impact is confined to availability - no confidentiality or integrity effect and no evidence of code execution. Vendor-released patch: 0.49.0; no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade kitty to 0.49.0 or later (release: https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0), which is the version that introduces the ensure_space_for_chars(&lc, lc.count + 1) capacity check in screen_handle_multicell_command(); downstream package maintainers should backport the change from commit https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b. If an immediate upgrade is not possible, treat this as a denial-of-service issue rather than a code-execution one and apply practical compensating controls: do not display untrusted or machine-generated terminal output in an affected kitty instance (view it with an alternative terminal emulator, with cat/less piped to a file, or with escape-sequence sanitization such as stripping OSC 66 sequences before display), and keep untrusted sessions in a separate kitty process and, where feasible, a distinct low-privilege user or sandbox so that a crash cannot terminate valuable child processes. There is no kitty configuration toggle that disables the text sizing protocol, so the trade-off for these workarounds is reduced convenience or the need to run a second terminal emulator; note also that because kitty exits on the fault, any work performed by its child processes is lost, so avoid running long-lived or interactive jobs in an affected terminal while unpatched. Confirm exposure against CPE cpe:2.3:a:kovid_goyal:kitty:*:*:*:*:*:*:*:* and monitor the vendor changelog and the Secur0 advisory at https://secur0.com/en/cna/cve-list/cve-2026-80431-kitty-text-sizing-out-of-bounds-write for updates. No vendor patch was identified as missing - the fix is available - and there is no public exploit identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
kitty implements a text sizing protocol (OSC 66) that lets programs specify cell dimensions for rendered text. In the natural-width branch (no explicit 'w' key) of screen_handle_multicell_command() in kitty/screen.c, the function accumulates the codepoints of a grapheme cluster into a local list object, 'lc', which the RAII_ListOfChars macro declares as a four-element char_type array in the function's stack frame. The accumulation loop writes lc.chars[lc.count++] = ch with no capacity check; grapheme segmentation and wcwidth checks only decide whether a codepoint belongs to the current cell, not whether the buffer has room. A grapheme cluster longer than four codepoints therefore writes past the end of the stack buffer, one 32-bit value per extra codepoint, in payload order - the CWE-787 root cause class. If the same payload contains a preceding sequence that forces an intermediate flush, ensure_space_for_chars() first migrates the list to the heap, so the overflow lands past the heap allocation instead; the outcome (memory corruption leading to process termination) is the same. Notably, the per-cell text is later capped at MAX_NUM_CODEPOINTS_PER_CELL (24), but that cap is applied after the unbounded accumulation, so it provides no protection. The affected CPE is cpe:2.3:a:kovid_goyal:kitty:*:*:*:*:*:*:*:*, covering the terminal application itself.
Know when Kitty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local delivery via terminal output (AV:L) with victim rendering the content (UI:R); no privileges (PR:N); crash-only impact kills the process and children, so A:H and C:N/I:N.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
DescriptionCVE.org
Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows r
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code bec
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insuffic
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insuf
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insuf
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code e
Heap memory corruption in Kitty cross-platform GPU terminal emulator (versions 0.46.2 and below) allows remote attackers
Heap buffer overflow in Kitty terminal versions 0.46.2 and below allows any process able to write to the terminal's stan
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that ma
Remote code execution in Kitty terminal emulator versions prior to 0.47.0 allows any process or remote peer that can wri
Command injection in Kitty cross-platform GPU terminal emulator versions prior to 0.47.0 allows remote attackers to exec
Exploit-DB