The vulnerability arises in kitty's screen_handle_multicell_command() function, which appends each codepoint of a grapheme cluster to a fixed-size four-element array without checking capacity. When an OSC 66 escape code payload contains a grapheme cluster longer than four codepoints, it writes past the buffer boundary. If an intermediate flush occurs, the buffer migrates to the heap, but the out-of-bounds write still happens beyond the allocated heap space. This results in process termination.

Exploitation causes the kitty terminal process to terminate unexpectedly, which in turn closes all windows, tabs, and child processes managed by kitty. This leads to denial of service for users relying on the terminal emulator. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted OSC 66 escape codes with long grapheme clusters in kitty. Monitor vendor channels for updates.