CVE-2026-33633 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
A heap buffer overflow in the Kitty terminal allows attackers to cause denial of service or potentially execute arbitrary code via crafted graphics protocol commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33633?
CVE-2026-33633 is a high-severity memory corruption vulnerability in kovidgoyal kitty, published on 19 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
Weakness: CWE-122
Which versions are affected by CVE-2026-33633?
It affects 1 product.
Products include Kovidgoyal Kitty.
How do I fix CVE-2026-33633?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-33633 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33633 exists.
Other vulnerabilities in kovidgoyal kitty
- CVE-2026-33642 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
- CVE-2026-42851 @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
- CVE-2026-54056 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
- CVE-2026-42850 Kitty has a shell command injection
- CVE-2026-54057 Kitty vulnerable to command injection via unsanitized OSC 21 query reply
Sources
Also known as DEBIAN-CVE-2026-33633, GHSA-j68c-v8x4-269g, UBUNTU-CVE-2026-33633.