CVE-2026-33633 Details
Description
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
A heap buffer overflow vulnerability has been identified in Kitty, a cross-platform GPU-based terminal, in versions through 0.46.2. The issue arises in the graphics protocol handler, specifically within the 'load_image_data()' function. The vulnerability can be exploited by any process that writes to the terminal's standard input, causing Kitty to crash immediately. The overflow is triggered by an APC graphics protocol command that includes a PNG format declaration, where the payload exceeds twice the initial buffer capacity. This attacker-controlled overflow leads to a confirmed denial-of-service condition and potentially allows for remote code execution.
Users are advised to update to Kitty version 0.47.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g | CISA-ADP | ExploitVendor Advisory |
| https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34 | [email protected] | Patch |
| https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kovidgoyal kitty | < 0.47.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | Initial Analysis | [email protected] |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |