Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the… (CVE-2026-80431)

The vulnerability in kitty (CVE-2026-80431) is an out-of-bounds write triggered by a program writing to the terminal using an OSC 66 escape code payload containing a grapheme cluster longer than four codepoints. The function screen_handle_multicell_command() appends each codepoint to a fixed-size four-element array without capacity checks, leading to writes past the buffer. If an intermediate flush occurs, the buffer migrates to the heap, but writes still exceed the allocated space. This results in process termination of kitty and its associated windows and child processes.

Exploitation of this vulnerability causes the kitty terminal process to terminate unexpectedly, which in turn closes all windows, tabs, and child processes managed by kitty. This results in denial of service for users relying on the terminal emulator. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted OSC 66 escape codes with potentially long grapheme clusters in kitty terminal sessions.