CVE-2026-33633 is a heap buffer overflow vulnerability (CWE-122) in the kitty terminal emulator maintained by kovidgoyal. The vulnerability exists in the load_image_data() function, triggered by an APC graphics protocol command with a PNG format (f=100) whose payload length exceeds twice the initial buffer capacity. Both the length and content of the overflow are attacker-controlled, allowing denial of service and possible remote code execution. This affects kitty versions prior to 0.47.0. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Exploitation allows any process that can write to kitty's stdin to cause an immediate crash, resulting in denial of service. Due to attacker control over the overflow length and content, there is potential for escalation to remote code execution. The vulnerability impacts confidentiality, integrity, and availability of the affected system running vulnerable kitty versions.

Upgrade kitty to version 0.47.0 or later, where this heap buffer overflow vulnerability has been fixed. Since this is a client-side application and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.