CVE-2024-25004

2024-02-0907:16:00

Google

osv.dev

kitty version

buffer overflow

input sanitization

arbitrary code execution

security vulnerability

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

20.9%

JSON

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.

CPENameOperatorVersion
kittyeq0.74.2.5
kittyeq0.74.4.5
kittyeq0.74.3.1
kittyeq0.76.0.4
kittyeq0.76.0.10
kittyeq0.76.1.4
kittyeq0.74.4.2
kittyeq0.76.0.12
kittyeq0.71.0.1
kittyeq0.76.0.2

Name	Operator	Version
kitty	eq	0.74.2.5
kitty	eq	0.74.4.5
kitty	eq	0.74.3.1
kitty	eq	0.76.0.4
kitty	eq	0.76.0.10
kitty	eq	0.76.1.4
kitty	eq	0.74.4.2
kitty	eq	0.76.0.12
kitty	eq	0.71.0.1
kitty	eq	0.76.0.2