CVE-2026-33633: CWE-122: Heap-based Buffer Overflow in kovidgoyal kitty
Kitty terminal versions 0.46.2 and below contain a heap-based buffer overflow vulnerability in the load_image_data() function. This flaw is triggered by a specially crafted APC graphics protocol command with a PNG format declaration whose payload exceeds twice the initial buffer capacity. The vulnerability allows any process that can write to the terminal's stdin to crash kitty immediately, causing denial of service. Additionally, the overflow is attacker-controlled in length and content, which may lead to remote code execution. This issue has been fixed in version 0.47.0.
AI Analysis
Technical Summary
CVE-2026-33633 is a heap-based buffer overflow vulnerability (CWE-122) in the kitty terminal emulator (versions ≤ 0.46.2) within the load_image_data() function. The vulnerability is triggered by an APC graphics protocol command with a PNG format declaration (f=100) whose payload size exceeds twice the initial buffer capacity, allowing an attacker who can write to the terminal's stdin to cause an immediate crash (DoS) and potentially escalate to remote code execution. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and was fixed in kitty version 0.47.0.
Potential Impact
Exploitation of this vulnerability allows an attacker with the ability to write to the terminal's stdin to cause a denial of service by crashing the kitty terminal. Due to the attacker-controlled overflow in both length and content, there is also potential for remote code execution, which could lead to full system compromise. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Upgrade kitty to version 0.47.0 or later, where this heap-based buffer overflow vulnerability has been fixed. Until the update is applied, restrict or monitor processes that can write to the terminal's stdin to reduce exposure. Patch status is confirmed fixed in the official release 0.47.0.
CVE-2026-33633: CWE-122: Heap-based Buffer Overflow in kovidgoyal kitty
Description
Kitty terminal versions 0.46.2 and below contain a heap-based buffer overflow vulnerability in the load_image_data() function. This flaw is triggered by a specially crafted APC graphics protocol command with a PNG format declaration whose payload exceeds twice the initial buffer capacity. The vulnerability allows any process that can write to the terminal's stdin to crash kitty immediately, causing denial of service. Additionally, the overflow is attacker-controlled in length and content, which may lead to remote code execution. This issue has been fixed in version 0.47.0.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-33633 is a heap-based buffer overflow vulnerability (CWE-122) in the kitty terminal emulator (versions ≤ 0.46.2) within the load_image_data() function. The vulnerability is triggered by an APC graphics protocol command with a PNG format declaration (f=100) whose payload size exceeds twice the initial buffer capacity, allowing an attacker who can write to the terminal's stdin to cause an immediate crash (DoS) and potentially escalate to remote code execution. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and was fixed in kitty version 0.47.0.
Potential Impact
Exploitation of this vulnerability allows an attacker with the ability to write to the terminal's stdin to cause a denial of service by crashing the kitty terminal. Due to the attacker-controlled overflow in both length and content, there is also potential for remote code execution, which could lead to full system compromise. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Upgrade kitty to version 0.47.0 or later, where this heap-based buffer overflow vulnerability has been fixed. Until the update is applied, restrict or monitor processes that can write to the terminal's stdin to reduce exposure. Patch status is confirmed fixed in the official release 0.47.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-23T14:24:11.618Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0ca2183cb6383434df161b
Added to database: 05/19/2026, 17:47:04 UTC
Last enriched: 05/26/2026, 20:46:35 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.