EUVD-2026-87233
GHSA-3v4f-mq3r-g3gv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun malicious program in kitty window
-
DeliveryUser initiates drag from terminal
-
ExploitEmit crafted DnD abort sequence
-
ExecutionTrigger use-after-free on freed DragRemoteItem
-
ImpactCrash or corrupt terminal heap
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires kitty version 0.47.0 up to (not including) 0.49.0 with the drag-and-drop protocol in use. Exploitation is reachable only via the DRAG SOURCE path: the user must be actively dragging content out of the terminal window (UI:A/UI:R), and a program with control of the terminal's output byte stream must emit drag-and-drop protocol sequences that force an error in the item-transfer helpers (toplevel_data_for_drag/subdir_data_for_drag → add_payload/populate_dir_entries). Specific trigger conditions per the description: a create failing because two declared entries share one name (O_CREAT|O_EXCL / symlinkat collision), a mkdirat() failure other than EEXIST, or directory-entry allocation failure - all of which route through the abrt() macro and free the offer. LIMITING FACTORS: local access only (attacker code/output must run inside the kitty window), an active user drag operation is required, and the outcome is undefined behavior (crash/bounded corruption) rather than confirmed code execution; no confidentiality impact. |
| Impact | This is a genuine memory-safety flaw (CWE-416 use-after-free) but the aggregate signals point to LOW real-world priority, consistent with the vendor's 4.6 CVSS 4.0 base score. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L) tells the real story: the attack vector is LOCAL, not network - the trigger is bytes on a terminal's own output stream, so an attacker must already have a program executing (or output being rendered) inside a vulnerable kitty window. UI:A confirms an active user action is part of the chain (the drag-source path only runs while the user is dragging content out of the terminal). Impact is limited: VC:N (no confidentiality), VI:L and VA:L (partial integrity/availability) - meaning the realistic outcome is a terminal crash or bounded heap corruption/undefined behavior, not reliable code execution or data theft. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict: the low CVSS, local vector, required user interaction, and absence of exploitation evidence all agree this is a defensive/hardening fix rather than an urgent, widely-exploitable issue. One caveat for defenders: the description notes the bug is 'reachable from the byte stream of any program running in the window,' so a malicious file cat'd to the terminal or hostile output over SSH could be the delivery method - but a user-initiated drag operation is still required to reach the vulnerable code, keeping practical exploitability low. |
| Exploit ScenarioDerived | A user runs kitty (0.47.0-0.48.x) and initiates a drag of file(s) out of the terminal window; a program running in that window (e.g., a malicious script, or hostile output piped/streamed into the terminal such as over SSH) emits crafted drag-and-drop protocol escape sequences that abort a drag-source item mid-transfer. The abort tears down the drag offer and frees the DragRemoteItem array while the caller in drag_remote_file_data() still holds and dereferences (and writes through) the freed pointer, producing undefined behavior - typically a crash or bounded heap corruption. No public exploit code is referenced, and the local vector plus required drag interaction make weaponization unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Use-after-free in the drag-and-drop source path of the kitty terminal emulator (versions 0.47.0 up to but not including 0.49.0) allows any program that controls the terminal's output byte stream to make the terminal read from and write to freed heap memory while the user is actively dragging content out of the window. The flaw lives in drag_remote_file_data() in kitty/dnd.c, which keeps a DragRemoteItem pointer into an array that the error path's cancel_drag()/drag_free_offer() teardown frees, then continues to dereference and write through it; per the assessed vector this is a local, user-interaction-required issue (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) with integrity and availability impact only and no confidentiality impact, matching the vendor's low 4.6 CVSS 4.0 base score. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); a vendor patch is available in kitty 0.49.0.
RemediationAI
Upgrade to kitty 0.49.0 or later - the vendor-released fix is contained in release v0.49.0 (upstream commit b54bfbb4f85f992edca9b04f5c0c2612454eec23, https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0), which changes the transfer helpers to return false on abort and have drag_remote_file_data() stop touching the freed DragRemoteItem, so upgrading removes the use-after-free entirely. There is no indication of a configuration toggle that disables the drag-and-drop protocol, so if an immediate upgrade is not possible the effective compensating control is to avoid initiating drag-out-of-terminal operations from windows running untrusted or interactive programs until the upgrade is applied - this limits the attack to the drag source path (the user must be actively dragging, consistent with UI:R/UI:A) but imposes a real usability trade-off on any drag-and-drop workflow, including dragging files or text out of the kitty window. Additional hardening that reduces the attack surface without removing the bug: run untrusted command-line programs in a restricted context where possible, and avoid running attacker-influenced output-producing programs in kitty windows on kitty builds in the 0.47.0-0.48.x range. Note that the impact per the assessed vector is bounded (integrity and availability only, no confidentiality impact, undefined behaviour rather than confirmed code execution), so the priority is expedient upgrade rather than emergency containment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-416 use-after-free in kitty's drag-and-drop protocol implementation (kitty/dnd.c), specifically in the drag source ('drag out of the terminal') code path. drag_remote_file_data() holds a DragRemoteItem pointer into an array it does not own, then calls the transfer helpers toplevel_data_for_drag() or subdir_data_for_drag(), which in turn call add_payload() and populate_dir_entries(). These helpers report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return; cancel_drag() invokes drag_free_offer(), which frees the very array the caller's pointer refers to. Because the helpers are declared void, the caller receives no signal that teardown occurred and proceeds to call all_children_complete() on the freed pointer, dereferencing it and then writing through it. The dereference is gated by a local flag set only when the request carries no payload and announces no further data - the same condition that selects the finalisation block of add_payload() - so the following error paths reach it: a create that fails because an entry of the same name already exists (clients may declare two entries with one name, and creation uses O_CREAT with O_EXCL and symlinkat()), a mkdirat() failure other than EEXIST, and directory-entry allocation failures. Both the top-level and sub-directory branches are affected: in the top-level branch the caller's pointer is never cleared, and in the sub-directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts are caught by a null check, but a subsequent abort inside add_payload() leaves the caller holding a freed child node in the item tree that drag_free_offer() recursively frees. The result is undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window. The affected package is identified by CPE cpe:2.3:a:kovid_goyal:kitty (version range 0.47.0 <= v < 0.49.0).
Know when Kitty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Local trigger via terminal byte stream (AV:L), no privileges needed (PR:N), but requires an active user drag (UI:R); UAF yields bounded corruption/crash - I:L/A:L, C:N.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
DescriptionCVE.org
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O_CREAT with O_EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add_payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag_free_offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows r
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code bec
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insuffic
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insuf
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insuf
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code e
Heap memory corruption in Kitty cross-platform GPU terminal emulator (versions 0.46.2 and below) allows remote attackers
Heap buffer overflow in Kitty terminal versions 0.46.2 and below allows any process able to write to the terminal's stan
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that ma
Remote code execution in Kitty terminal emulator versions prior to 0.47.0 allows any process or remote peer that can wri
Command injection in Kitty cross-platform GPU terminal emulator versions prior to 0.47.0 allows remote attackers to exec
Exploit-DB