PT-2026-98850

Name of the Vulnerable Software and Affected Versions kitty versions 0.40.0 through 0.48.x Description An out-of-bounds write exists in the natural width branch of the text sizing protocol. The screen handle multicell command function in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-95832: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...

CVE-2026-80430: Improper Link Resolution Before File Access

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

CVE-2026-80432: Missing Authorization

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because dropenqueuerequest in kitty/dnd.c...

PT-2026-98931

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag remote file data in kitty/dnd.c holds a DragRemoteItem pointer into an...

PT-2026-98841

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color control in kitty/window.py...

Linux Distros Unpatched Vulnerability : CVE-2026-95832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49....

Linux Distros Unpatched Vulnerability : CVE-2026-95834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the...

Ubuntu 24.04 LTS / 26.04 LTS : kitty vulnerabilities (USN-8763-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8763-1 advisory. It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker...

USN-8763-1: kitty vulnerabilities

It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker could possibly use this issue to execute arbitrary commands. CVE-2026-42850 It was discovered that kitty incorrectly handled remote edit requests in termina...

USN-8763-1 kitty vulnerabilities

It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker could possibly use this issue to execute arbitrary commands. CVE-2026-42850 It was discovered that kitty incorrectly handled remote edit requests in termina...

openSUSE 16 Security Update : kitty (openSUSE-SU-2026:21599-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21599-1 advisory. Changes in kitty: - Update to 0.48.2: Wayland: Fix regression in previous release that broke drag and drop on Plasma 10284 diff kitten: Fix a ra...

SUSE CVE-2026-33633

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in loadimagedata that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG...

SUSE CVE-2026-33642

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handlecomposecommand function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer...

OPENSUSE-SU-2026:21599-1 Security update for kitty

This update for kitty fixes the following issues: Changes in kitty: - Update to 0.48.2: Wayland: Fix regression in previous release that broke drag and drop on Plasma 10284 diff kitten: Fix a rare crash when showing a large diff due to incorrect locking when highlighting Allow the private DCS...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: pdfcpu, gitea, kubescape, gitea-fips, kitty, ollama, seaweedfs-operator, bento-fips, rclone, nemo, mattermost, seaweedfs-fips, mattermost-fips, mailpit, seaweedfs-rocksdb-fips, ollama-fips, fortio-fips, bento, seaweedfs-operator-fips, kubescape-server-fips,...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: pdfcpu, gitea, kubescape, gitea-fips, kitty, ollama, seaweedfs-operator, bento-fips, rclone, nemo, mattermost, seaweedfs-fips, mattermost-fips, mailpit, seaweedfs-rocksdb-fips, ollama-fips, fortio-fips, bento, seaweedfs-operator-fips, kubescape-server-fips,...

SUSE CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913

A flaw was found in Kitty, a cross-platform GPU based terminal. This vulnerability allows an attacker to achieve arbitrary code execution by chaining specific escape sequences @kitty-echo and @kitty-ssh when a user displays untrusted terminal data. These sequences write unauthenticated data to th...

Linux Distros Unpatched Vulnerability : CVE-2026-72913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the...