This vulnerability arises from improper handling of pointers in the drag_remote_file_data() function within kitty's drag and drop code. Specifically, a DragRemoteItem pointer into an array not owned by the function is used after the array is freed during error handling paths. The error handling uses an abrt() macro that cancels the drag and frees memory but does not inform the caller, which then continues to dereference and write through the freed pointer. This use-after-free condition can be triggered by programs writing to the terminal that initiate drag and drop operations with certain error conditions, leading to undefined behavior in the terminal process.

Exploitation of this vulnerability can cause the kitty terminal process to read from and write to freed heap memory, resulting in undefined behavior. The CVSS 4.0 base score is 4.6 (medium severity), reflecting local attack vector with low complexity and requiring user interaction. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid running untrusted programs that might trigger drag and drop operations in kitty, or consider using a different terminal emulator version outside the affected range.