CVE-2024-25003

2024-02-0907:16:00

Google

osv.dev

kitty

buffer overflow

input sanitization

arbitrary code execution

cve-2024-25003

security issue

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

20.9%

JSON

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.

CPENameOperatorVersion
kittyeq0.74.2.5
kittyeq0.74.4.5
kittyeq0.74.3.1
kittyeq0.76.0.4
kittyeq0.76.0.10
kittyeq0.76.1.4
kittyeq0.74.4.2
kittyeq0.76.0.12
kittyeq0.71.0.1
kittyeq0.76.0.2

Name	Operator	Version
kitty	eq	0.74.2.5
kitty	eq	0.74.4.5
kitty	eq	0.74.3.1
kitty	eq	0.76.0.4
kitty	eq	0.76.0.10
kitty	eq	0.76.1.4
kitty	eq	0.74.4.2
kitty	eq	0.76.0.12
kitty	eq	0.71.0.1
kitty	eq	0.76.0.2