Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to… (CVE-2026-95834)

CVE-2026-95834 describes a use-after-free vulnerability in kitty terminal's drag and drop protocol implementation affecting versions from 0.47.0 before 0.49.0. The vulnerability occurs because drag_remote_file_data() holds a pointer to an array it does not own and calls helper functions that may free this array during error handling without notifying the caller. Subsequent code dereferences and writes through this freed pointer, guarded only by a local flag that does not prevent the use-after-free in all cases. The error paths involve failures such as duplicate entry creation or directory creation errors, leading to undefined behavior in the terminal process. This flaw can be triggered by any program writing to the terminal, making it a local vector with user interaction required.

Exploitation of this vulnerability can cause the kitty terminal process to access freed heap memory, leading to undefined behavior such as crashes or potential memory corruption. The vulnerability requires local access and user interaction (UI) and does not involve privilege escalation or network attack vectors. There are no known exploits in the wild. The impact is rated medium severity due to the potential for instability or memory corruption within the terminal process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running untrusted programs that interact with the kitty terminal's drag and drop protocol. Monitor vendor channels for updates and apply patches promptly once released.